A security flaw hidden in PHP for 14 years is now one of the internet’s most urgent patching jobs. On Oct. 21, the PHP Foundation disclosed two critical vulnerabilities, known as “php2shell,” that allow attackers to execute code remotely on unpatched systems running up to 70% of websites. Researchers used AI models to find it in August.
AI found it, and attackers have AI too
Security teams at Calif, OpenAI, and Wiz each identified parts of the issue in August using AI models, including OpenAI’s GPT-5.6 Sol and Google’s Gemini 4 Argon. A limited version of the flaw surfaced in 2024 and was dismissed as minor. AI changed that by working out how to turn the weakness into a working exploit.
As Fortune reports, the coordinated effort means a fix is available, but the open question is whether organizations will apply it before attackers move. Cloudflare saw early exploitation attempts within hours of the news breaking, and at least one startup owner reported that hackers allegedly stole source code and leaked legal documents.
Exploitation and response
Amazon Web Services reported on Oct. 21 that the vulnerability is “now being broadly exploited in the wild,” and said it had seen some attempts in the days before disclosure. Palo Alto Networks’ initial analysis identified 22.6 million potentially vulnerable instances. The FBI’s cyber division and the NSA urged potentially affected organizations to update. Agencies in the Netherlands and Finland took websites offline, Reuters reported.
What php2shell means for BPO clients and providers
The lesson for business and IT leaders is direct. Finding vulnerabilities is no longer the slow part. AI has made discovery fast and cheap for defenders and attackers alike. The bottleneck now is how quickly a company can locate affected software and push the fix.
Start with an inventory. PHP often runs in places nobody thinks about, such as customer portals, internal dashboards, legacy intranets, plugins, and vendor-hosted tools. Confirm the PHP version on every system, apply the patch, and take offline anything that cannot be patched quickly. Then ask the same questions of third parties, since a vendor’s unpatched server can provide a path into your own network.
BPO providers commonly run PHP-based dialers, ticketing systems, QA tools, and client portals, many of which are connected directly to clients’ CRMs, payment systems, and customer data. That makes an unpatched provider a ready entry point into the client’s environment, and php2shell turns that third-party risk from theoretical to immediate.
Clients should ask their BPO partners now whether they have patched, which systems were affected, and when the work was completed. They should expect written confirmation rather than verbal assurance.
For providers, fast and transparent patch reporting is now part of the service. Those who can show a documented inventory, rapid remediation, and clear incident communication will strengthen client trust. Those who cannot will see security questions move to the top of every contract renewal.
Read more Unity Communications and BPO News on our main page.
Tzadik, S., Tamari, S., Ohfeld, N., & Schwartz, T. (2026, October 21. PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet. Wiz. Retrieved from https://www.wiz.io/blog/php2shell-php-rce
Forlini, E. (2026, October 21). AI tools discovered the PHP vulnerability that could take down 70% of the internet. Now, the race is on to patch it before AI-powered hackers attack. Fortune. Retrieved from https://fortune.com/2026/10/21/ai-tools-discovered-the-php-vulnerability-that-could-take-down-70-of-the-internet-now-the-race-is-on-to-patch-it-before-ai-powered-hackers-attack/
Satter, R., Marchandon, L., Ghosh, K., Pardesi, R. (2026, October 21). Government websites go dark after AI-discovered flaw sparks security scramble. Reuters. Retrieved from https://www.reuters.com/world/asia-pacific/eu-agency-warns-websites-may-need-be-taken-offline-php-prepares-patches-2026-10-21/
