Critical Security Flaw Puts 70% of the World’s Websites at Risk.

A major cybersecurity alert is sweeping the internet after artificial intelligence helped researchers uncover critical software vulnerabilities dubbed PHP2Shell, potentially exposing millions of websites to remote hacking attacks. Discovered in PHP, the programming language powering an estimated 70% of websites worldwide, the flaws could allow attackers to execute unauthorized code on vulnerable servers, steal sensitive information, and compromise websites running popular platforms such as WordPress, Drupal, and Joomla. Tracked as CVE-2026-109618 and CVE-2026-109619, the vulnerabilities received emergency security patches on October 21, 2026, prompting cybersecurity experts to urge website owners and hosting providers to update affected PHP installations immediately. The discovery highlights AI’s growing dual role in cybersecurity: helping defenders expose long-hidden software weaknesses while potentially enabling criminals to develop sophisticated exploits faster. Read the detailed technical analysis from Wiz Research and the official PHP security updates.