समाचार Samāchār · Tech & AI · 21 October 2026

AI-found PHP2Shell flaws force emergency patches across the web

Two critical bugs in the PHP engine, found with OpenAI’s GPT-5.6 Sol and separately by Wiz, were patched a day early on 21 October as attackers began probing.

The PHP project released emergency fixes on 21 October for two critical flaws that let an attacker run code on a server without logging in. PHP runs most websites whose server language is known, including WordPress, Drupal and Laravel sites.

The security firm Calif found the bugs using OpenAI’s GPT-5.6 Sol, and Wiz found them independently. OpenAI said frontier AI had found them before attackers did. Patches for PHP 8.2 to 8.5 came out a day early after the bug identifiers leaked.

Amazon reported a first exploitation attempt on 17 October, four days before disclosure, and Sophos linked later attempts to a Mirai-variant botnet. Some public-sector sites in Europe went offline as a precaution. Qualys estimated that about 71 per cent of PHP installations run versions that no longer receive fixes. Reports on confirmed compromises still differ.

What a founder takes from it: AI is shrinking the gap between a bug being found and being used to days. An old PHP stack is now a business risk, not just technical debt.