AI tools discovered the PHP vulnerability that could take down 70% of the Internet. Now the race is on to patch it before AI-powered hackers attack

Increasingly powerful AI tools are at the center of a new war between those who want to use them to supercharge cyberattacks, and the defenders who are harnessing the same tools to fend them off.

Today, the defenders are hoping they got a leg up in identifying a critical issue that stands to take down 70% of the internet if left unaddressed.

While the software flaws have now been found and patches issued, the question remains whether enough of the internet will deploy the patches in time, before hackers start exploiting the vulnerability to attack websites and steal vital data.

Most web pages run using an open-source programming language called PHP.

That language is maintained by the PHP Foundation.

Today, the foundation disclosed two “critical” software vulnerabilities and issued an emergency patch, urging websites to implement it immediately or take down their websites until they are able to.

The vulnerabilities are named CVE-2026-109618 and CVE-2026-109619 and collectively called “php2shell.” As reports broke overnight of the vulnerabilities ahead of the patch’s official release, some opportunistic attackers tried to exploit it.

Cloudflare, a global cybersecurity company that helps secure millions of websites, according to its website, began seeing “early attacks,” according to its CTO Dane Knecht.

While instances of successful breaches are still limited and unfolding, one startup owner reported that the PHP bug is “real bad” and says everyone should be “afraid” after hackers allegedly stole their source code, exposed cookie data, and leaked legal documents.

Multiple governments have decided to take websites offline as a safety precaution, including some agencies in the Netherlands and Finland, Reuters reported .

The Federal Bureau of Investigation’s (FBI) Cyber Division and the National Security Agency (NSA) both issued statements urging potentially affected organizations to update their services, as did the Prime Minister of Japan, the European Union Computer Emergency Response Team (CERT), and several other national agencies.

“The impact of the PHP vulnerabilities is massive, [and] can expose a large number of websites to immediate attacks if not patched in time,” Gang Wang, Associate Professor of Computer Science at the University of Illinois’ Grainger Engineering, told Fortune .

The bugs allow bad actors to remotely execute code on flawed, not-yet-patched PHP systems.

Attackers can use that as an “entry point into the network hosting that machine, and from there potentially carry out attacks that cause significant damage,” Wang’s colleague David Nicol, Director of the Information Trust Institute at the University of Illinois’ Grainger College of Engineering told Fortune .