Updated Oct. 21, 2026, 12:08 p.m. ET
PHP, a programming language that powers as much as 70% of the world’s websites and web applications, disclosed two critical security issues on Tuesday, Oct. 20, that could leave it vulnerable to hackers.
The issues would allow bad actors to steal information or launch a cyberattack on anyone visiting a hacked website. PHP software powers WordPress, Drupal, Joomla, and Magento websites, according to a blog post by Huntress cybersecurity researcher John Hammond.
“When a critical bug lands in PHP itself, rather than in one app built on top of it, the number of places you have to go looking to identify vulnerable PHP versions gets very big, very fast,” he wrote.
The issue, called PHP2Shell, was the first caught by researchers at Calif, a digital infrastructure defense firm, in August, with help from one of OpenAI’s most advanced models, according to OpenAI.
Google’s Wiz cybersecurity team also independently discovered and reported the vulnerabilities.