Critical PHP flaws expose majority of web infrastructure to AI-driven attacks
Security researchers disclosed a critical PHP vulnerability allowing remote code execution without login, affecting up to 70% of websites. The incident triggered a global security response, with the NSA advising organizations to take systems offline until patched.
A critical vulnerability in PHP, dubbed 'PHP 2 Shell' by some researchers and 'PHP to Shell' by others, allows remote code execution without authentication. The flaw impacts all PHP versions from the past 20 years, affecting approximately two-thirds to 70% of active websites worldwide. Discovered two months ago using AI models, including OpenAI’s GPT-5.6 Sol and an autonomous system by Wiz, the bug was identified independently by a researcher at Calif and by Wiz, a Google subsidiary. Volker Dush, a security engineer at the PHP maintainer, described it as the most severe issue in over a decade, comparing its impact to Heartbleed.
Knowledge of the exploit spread ten hours before public disclosure, prompting the NSA to advise organizations to take systems offline until patches were applied. Cloudflare CEO Matthew Prince reported thousands of exploitation attempts in the ten hours pre-announcement, rising to millions shortly after. In Germany, the City of Mainz, the Federal Ministry of the Interior, constitutional protection agencies, hospitals, and airports temporarily took websites offline. Cloudflare CTO Dan Knecht confirmed immediate attacks following the patch release. The incident has driven stock gains for security firms, with Cloudflare shares rising nearly 7%, Palo Alto Networks 4%, and CrowdStrike 3%. OpenAI President Greg Brockman stated that the industry is entering a new phase where models find internet-scale vulnerabilities, suggesting authorized defenders may need to remotely patch systems to match the speed of AI-driven attacks.