AI tools discovered the PHP vulnerability that could take down 70% of the internet. Now, the race is on to patch it before AI-powered hackers attack

Increasingly powerful AI tools are at the center of a new war between those who want to use them to supercharge cyberattacks, and the defenders who are harnessing the same tools to fend them off. Today, the defenders are hoping they got a leg up in identifying a critical issue that stands to take down 70% of the internet if left unaddressed.While the software flaws have now been found and patches issued, the question remains whether enough of the internet will deploy the patches in time, before hackers start exploiting the vulnerability to attack websites and steal vital data.

Most web pages run using an open-source programming language called PHP. That language is maintained by the PHP Foundation. Today, the foundation disclosed two “critical” software vulnerabilities and issued an emergency patch, urging websites to implement it immediately or take down their websites until they are able to. The vulnerabilities are named CVE-2026-109618 and CVE-2026-109619 and collectively called “php2shell.” 

As reports broke overnight of the vulnerabilities ahead of the patch’s official release, some opportunistic attackers tried to exploit it. Cloudflare, a global cybersecurity company that helps secure millions of websites, according to its website, began seeing “early attacks,” according to its CTO, Dane Knecht. While instances of successful breaches are still limited and unfolding, one startup owner reported that the PHP bug is “real bad” and says everyone should be “afraid” after hackers allegedly stole their source code, exposed cookie data, and leaked legal documents.

Multiple governments have decided to take websites offline as a safety precaution, including some agencies in the Netherlands and Finland, Reuters reported. The FBI’s cyber division and the National Security Agency both issued statements urging potentially affected........

© Fortune