AI finds critical flaw in software powering most of nation's websites
PHP, a programming language that powers as much as 70% of the world's websites and web applications, disclosed two critical security issues on Tuesday, Oct. 20, that could leave it vulnerable to hackers.
The issues would allow bad actors to steal information or launch a cyberattack on anyone visiting a hacked website. PHP software powers WordPress, Drupal, Joomla, and Magento websites, according to a blog post by Huntress cybersecurity researcher John Hammond.
"When a critical bug lands in PHP itself, rather than in one app built on top of it, the number of places you have to go looking to identify vulnerable PHP versions gets very big, very fast," he wrote.
The issue, called PHP2Shell, was the first caught by researchers at Calif, a digital infrastructure defense firm, in August, with help from one of OpenAI's most advanced models, according to OpenAI.
Google's Wiz cybersecurity team also independently discovered and reported the vulnerabilities.
White House says it's working to expedite release of software fix in US12:00 PM ET, October 21 2026, Joey Garrison
The Trump administration is working with federal agencies and artificial intelligence companies to "expedite the release" of the fix to users of the PHP programing and to protect American networks and critical infrastructure, the White House said in a statement.
The administration was notified on Friday, Oct. 16 of the PHP software vulnerability, which was discovered through AI technology. The open-source software is used by about 70% of websites globally.
The White House touted the fact it was AI ‒ which Trump has coined "super intelligence" ‒ that identified the vulnerabilities. Trump has pushed back against calls to regulate the rapidly growing AI industry.
“President Trump is committed to ensuring America leads the world in Super Intelligence, and this discovery demonstrates exactly why American leadership in SI is so critical," the White House said in a statement. "Advanced SI technology helped identify a cybersecurity vulnerability, allowing experts to develop a solution that would mitigate widespread disruptions."
What is a PHP and why is it important?11:51 AM ET, October 21 2026, Greta Cross
PHP, which stands for PHP: Hypertext Preprocessor, is a popularly used, open-source server-side scripting language used to develop websites and applications, according to educational computing site W3Schools. A PHP can generate dynamic page content; create, open, read, write and delete files on a server; collect form data; send and receive cookies; add, delete or modify data in a database; and encrypt data, as outlined by W3Schools.
As of this month, nearly 70% of all websites that have a known server-side language (when users can identify a site’s programming language) use a PHP, according to web tech survey platform W3Techs. Some of the world’s most popular websites use PHP, including WordPress, Facebook, Wikipedia, Slack, Etsy and Upwork, according to software development agency Trio.
And countless more are built on WordPress, including the White House and NASA websites.