By PYMNTS | October 22, 2026
Highlights
Two flaws in PHP, the code behind nearly 70% of websites, can let hackers take over a site without a password. AI found them after they sat hidden for more than a decade.
U.S. agencies told organizations to update PHP right away or take it offline if they can’t. Government agencies in the Netherlands, France, Denmark and Finland took websites offline as a precaution.
Japanese banks paused some services. MUFG Bank halted some online banking transactions, Mizuho stopped services and Shizuoka Bank shut its banking app. Japan’s bank settlement network was not affected.
Security flaws discovered with the help of artificial intelligence have triggered an urgent, OpenAI-led effort to protect websites worldwide, PYMNTS reported. The scramble exposes how quickly AI can uncover weaknesses in the software that supports online banking, payments and commerce.
The vulnerabilities affect PHP, a programming language used by nearly 70% of websites whose server-side language is known, according to Oct. 21 data from W3Techs, a web technology survey, Newsweek reported. Wiz researchers warned that attackers could exploit the flaws to take control of vulnerable servers, steal sensitive information or deface websites, PYMNTS reported. Still, the discovery does not mean every website using PHP is vulnerable. Exposure depends on the PHP version and how each system is configured, according to Newsweek.
For financial institutions, the danger extends beyond their core banking systems. Customer portals, merchant platforms, payment applications and third-party service providers may depend on software that banks do not directly control.
A compromised website could expose customer information, interrupt transactions or give attackers access to other connected systems.
AI Found Two PHP Flaws Hidden for More Than a Decade
On Wednesday (Oct. 21), the PHP Foundation, the nonprofit that maintains the language, released emergency security updates for two critical vulnerabilities, collectively known as PHP2Shell, according to its security advisory.
Calif, an AI security firm working in OpenAI’s Patch the Planet program, found the first flaw on Aug. 1 using OpenAI’s GPT-5.6 Sol, Fortune reported. Wiz, the Google-owned cloud security firm, found its first flaw independently on Aug. 19 using Google’s Gemini 4 Argon, GPT-5.6 Sol and its own Wiz Atlas research agent. One Wiz researcher did in about a week what once took a world-class team months, Wiz said in a blog post. The flaws had sat in PHP’s code for more than a decade, the company added.
Both flaws carry a 9.2 out of 10 severity rating, CNBC reported.
We’d love to be your preferred source for news.
Please add us to your preferred sources list so our news, data and interviews show up in your feed. Thanks!
OpenAI warned that the AI tools that find flaws like these “can also help attackers rapidly develop offensive tools and exploits,” PYMNTS reported. But the company said that to its knowledge, frontier AI found these vulnerabilities before attackers did.
PHP Sits Inside Vendor Software Banks Do Not Control
The Cybersecurity and Infrastructure Security Agency (CISA) said PHP is often a component of other software, so organizations may not see where it runs. CISA urged them to update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and take PHP-based systems offline if they cannot.
The FBI advised organizations to inventory where PHP runs, including products that bundle it, Newsweek reported. Wiz said that the flaws sit in PHP itself, so an application with secure code can still be exposed.
A bank’s core transaction-processing system might remain secure while a customer-facing website or third-party service is exposed. For payment processors and merchants, the consequences could include compromised customer data, interrupted checkout services and costly investigations.
Japanese Banks Hit Pause on Online Services
In Japan, several banks suspended services as a precaution. MUFG Bank halted some online banking transactions, and Daiwa Securities began emergency maintenance, Jiji Press reported. Shizuoka Bank disabled its online banking app until it confirms the service is safe and Mizuho’s bank and securities arms halted services, Bloomberg reported. The Japan Bankers Association said the network that settles funds between almost all domestic banks was not affected.
Airlines, railways and retailers followed suit. All Nippon Airways disabled boarding passes in Apple Wallet and said it found no evidence of a breach. Japan Airlines, East Japan Railway and Seven-Eleven Japan took some web services down, The Next Web reported.
Government agencies in the Netherlands, France, Denmark and Finland also took websites offline as a precaution, PYMNTS reported. Taking a vulnerable application offline may prevent an intrusion, but it can interrupt purchases, delay customer service and disrupt revenue-generating operations.