SI Caught a Hole in Up to 70% of the World's Websites. Then a Leak Gave Hackers a Head Start

Security researchers using Super Intelligence tools found two critical flaws in PHP, the free programming language that quietly runs up to 70% of the world's websites, and on Wednesday the people who maintain it rushed out an emergency fix. The bugs, nicknamed PHP2Shell, let a hacker anywhere take control of a website's server without a password, the PHP Foundation said.

PHP is the engine under WordPress, Drupal and the software that runs Wikipedia. You never see it, but it's there every time you log in to a shop, a bank portal or a government page. Think of it as a master key cut for seven out of every ten buildings in town. SI found the key before the burglars did. Then somebody left the blueprint on the front porch.

Found by SI, after humans missed it

The flaws had been hiding in PHP for more than a decade, the BBC reported. Researchers at the security firm Calif found one using OpenAI's GPT-5.6 Sol model as part of OpenAI's "Patch the Planet" program, and Wiz, Google's cloud security team, independently found and reported both, OpenAI said. OpenAI called it "one of the most impactful security issues in recent memory."

Humans had a shot at it first. A 2024 audit turned up early signs of the main bug, but nobody could prove it was exploitable, and work on a fix "stall[ed] and restart[ed] repeatedly over months," the PHP Foundation admitted. "We won't pretend otherwise: the delay was a structural failure," it wrote. Wiz said turning the old flaw into a working attack took "an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve," and frontier models were what made it practical, per Wiz's write-up.

The White House was told on Friday, Oct. 16, and said it was working with federal agencies and SI companies to "expedite the release" of the fix. "President Trump is committed to ensuring America leads the world in Super Intelligence, and this discovery demonstrates exactly why American leadership in SI is so critical," the White House said. "Advanced SI technology helped identify a cybersecurity vulnerability, allowing experts to develop a solution that would mitigate widespread disruptions," USA Today reported.

The plan, and the leak

The fix was supposed to go public on Thursday, Oct. 22, after weeks of quiet work so web hosts could patch everyone at once. It didn't hold. On Tuesday morning the two bug ID numbers started circulating online, so PHP moved the release up a day. That afternoon Calif "mistakenly" posted a video of its attack working on real targets, and copies spread on social media even after it was deleted, the foundation said.

Then, at 1:41 a.m. on Wednesday, more than six hours before the official release, the software security company Chainguard published updated PHP builds containing the fix. "Any attacker could now study the fix in binary form while every other PHP user was still waiting for the release," the PHP Foundation wrote. "This disregarded weeks of work by many parties toward a coordinated disclosure." Chainguard CEO Dan Lorenc told The Register his company "didn't leak" and that "These things are messy."

The bad guys noticed. Cloudflare, which guards a huge share of the web, had protective rules live about nine hours before the announcement. "Unfortunately the vulnerability leaked early, so we were already watching attackers mutate payloads against the rules and updating as variants appeared," Cloudflare's chief technology officer, Dane Knecht, wrote on X. The company saw "spikes of thousands of attempts," a Cloudflare director told USA Today.

Governments pull the plug

The National Security Agency told organizations that can't update right away to unplug. "If an immediate update is not feasible, it is recommended that organizations take the system offline until it can be fully mitigated," its cyber team posted on X, a warning seen nearly 8 million times. The NSA said hackers "are likely to weaponize" the flaws and that the risk is serious enough to require immediate patching across U.S. government departments, per its advisory. CISA, the federal cyber defense agency, gave the same advice, though it said it had not yet seen the bugs used in a real attack, per its alert.

Abroad, they didn't wait. Finland shut down its government's public web services, the Netherlands took its cyber agency's site offline, and parts of Wikipedia went dark while it patched, the BBC reported. Japan's prime minister, Sanae Takaichi, posted an "urgent request" for site owners to check whether they run PHP.

The ones that won't get fixed

The patch only covers PHP's newer versions. Cisco Talos, a major threat-research team, estimates about half of all PHP systems worldwide will never get an official fix because they run old, unsupported versions, USA Today reported. That's a lot of unlocked doors on old buildings nobody's watching.

For regular people, there's no button to press. The flaw lives on websites' servers, not your phone. Turn on two-step login for email and banking, and be wary of "security alert" emails and texts in the coming days, since crooks love to ride a headline.

OpenAI says this won't be the last one, and it expects findings like this "to increase sharply in the coming months." This time, the country that leads in SI found the hole first. That's the race worth winning.