A major security flaw has been discovered in PHP, a programming language used by around 70% of websites worldwide. The vulnerability could allow hackers to access website servers, steal sensitive information and damage websites if the affected systems are not updated. AI tools helped security researchers find the problem, raising fresh concerns about online safety. The security issue, known as PHP2Shell, affects PHP core software. PHP is widely used to build websites and web applications. Popular platforms such as WordPress, Drupal and Joomla also use PHP based technology.
Researchers from cybersecurity company Wiz and AI research firm Calif found serious weaknesses with help from advanced AI tools. The flaws had remained hidden for many years. According to researchers, attackers could use them to run harmful code on affected servers without needing to log in first. The good news is that fixes have been released. The PHP team worked with security researchers and technology companies to prepare updates before publicly sharing details of the vulnerabilities.
Website owners and hosting companies are now being urged to check their systems and install the correct security updates as soon as possible. Companies that cannot update immediately may need temporary protection measures. The discovery also highlights a growing concern: AI can help security experts find dangerous software flaws, but hackers may use similar technology to develop attacks faster. There were reports of attempts to exploit these weaknesses around the time the flaws became public. This makes quick security updates especially important.
