Here's how to protect your information from the PHP flaw, according to cybersecurity pros

• Cybersecurity researchers say the PHP vulnerability has repercussions for normal people, too.
• Even if you don't own a website, hackers could use the vulnerability to steal your information.
• One quick fix: diversify your passwords.

If you're still using the same password for everything, it might finally be time to get on that.

While the major cybersecurity vulnerabilities that OpenAI agents helped expose on Wednesday primarily impact the owners and operators of websites, it could also give hackers the opportunity to hijack your personal information, researchers said.

"Be extra careful visiting ANY web site in the next few days," Changpeng Zhao, the cofounder of cryptocurrency platform Binance, said on X.

OpenAI said on Wednesday that researchers using its AI models uncovered two "critical" flaws in the infrastructure of PHP, a popular open-source programming language used on about 70% of the world's websites.

Because digital commerce websites, for instance, can store personal shopper information in PHP systems, that information would be accessible to a bad actor exploiting the web provider's system if that provider hasn't updated it.

The National Security Administration warned that hackers using one of the PHP exploits could "steal sensitive data, disrupt services, or move deeper into a network."

"Even if you yourself are not building software and that's not where your core business is, a lot of your life does depend on companies that depend on those systems," Madeline Lawrence, cofounder of Aikido Security, an application security platform, told Business Insider on Thursday.

"And they could be deeply, deeply vulnerable," she added. She said that one day after the disclosure, cybersecurity platform Cloudflare reported millions of attempts to exploit the vulnerability.

If you do own a website, PHP has released updates it says will help shield websites from hackers. Instructions for applying those updates are available on PHP's homepage.

For everyone else, here are a few tips cybersecurity researchers say you can use to protect your info.

• Don't reuse passwords; use a password manager.
• Check for security advisories from your bank.
• Use two-factor authentication on your devices and accounts — especially for email, banking, and your password manager.
• If your data has been breached, expect more convincing scams and phishing emails.
• Turn auto-updates on and restart your computer weekly.

"You can ask your claude code to audit what on your laptop is out of date and needs updating," Peter Wildeford, head of policy at the AI Policy Network, a bipartisan nonprofit that advocates for safety guardrails and federal oversight, added in a post on X.

PSA: in light of recent cyberattacks and vulnerabilities, I recommend everyone:

* use a good password manager (1Password) and do not duplicate passwords
* use two factor auth for everything important (not via sms!! Google Authenticator or better yet YubiKey)
* Auto-updates on,…

— Peter Wildeford🇺🇸🚀 (@peterwildeford) October 21, 2026

Though Lawrence called the vulnerability "very severe," she cautioned against people running to close their bank accounts to protect themselves.

"Assume that if you're getting a notification that your data has been leaked," she said. "Take action on that because you could have credentials or information floating around the dark web."