PHP2Shell Flaws Trigger Global Cybersecurity Response

Critical vulnerabilities in PHP, a programming language used by more than 70 percent of websites worldwide, have prompted urgent security fixes and precautionary shutdowns of government and other public websites. The flaws, dubbed PHP2Shell, affect PHP versions 5.4 and later and arise from the way the software handles fatal errors, such as running out of memory. Exploitation could let attackers run code on affected websites, alter them, or access personal information and credentials stored in server memory. Both vulnerabilities received a critical severity score of 9.2 out of 10. Researchers at cybersecurity companies Calif and Wiz discovered the flaws independently with the help of artificial intelligence. Calif, working with OpenAI, reported one in August; Wiz reported the other later that month. The issues had been present in PHP’s code for more than a decade. Although researchers coordinated disclosure with PHP’s developers and others so fixes could be prepared, Amazon security chief CJ Moses said his team detected an attempted exploit on October 17, before the public disclosure. It remains unclear how the attacker learned of the vulnerabilities. PHP developers released fixes and urged users to update immediately. Experts nevertheless warned of potential attacks as operators raced to patch systems. Government and public-facing services in the Netherlands, Finland, France and Belgium were taken offline or placed into preventive maintenance. South Korea raised its cybersecurity alert level and issued guidance to thousands of companies and critical infrastructure operators. Wikipedia and the Internet Archive also took some systems offline temporarily. The article highlights the internet-wide implications of a flaw in foundational software, while noting that updated sites are protected. University of Melbourne lecturer Andrew Cullen also cautions that AI can help find and fix vulnerabilities, but can assist attackers in discovering or creating exploitable bugs as well.

Authorities in Europe, Asia and elsewhere have taken some government websites temporarily offline after researchers identified two critical vulnerabilities in PHP, a programming language used by a large share of websites. The US National Security Agency issued a rare public warning, advising organizations to update affected systems immediately or take websites offline until they can be patched. Germany, France, Belgium, the Netherlands, Finland and the Czech Republic reported taking websites offline or applying security measures. Japan’s Prime Minister Sanae Takaichi also warned about the risk on social media. The vulnerabilities, collectively dubbed PHP2Shell, were discovered with assistance from artificial intelligence tools. Researchers at Calif, working with OpenAI, reported one flaw on August 11; Wiz, an Alphabet-owned security firm, reported the other on August 24. Wiz described the findings as among the most severe vulnerabilities found in PHP and said the underlying flaws had existed for decades. Demonstrating how to exploit them required a sequence of steps that had been difficult for human researchers to accomplish. The flaws involve unauthorized access to portions of computer memory. An attacker could use them to run commands remotely on a server using vulnerable PHP code, without a password or legitimate account. The nonprofit PHP Foundation called the vulnerabilities among the most severe it had encountered and urged website administrators to update their code immediately. The Foundation also warned that AI could make security weaknesses easier to find, benefiting both defenders and attackers. It called for technology companies to coordinate their response to reduce the risk of major disruption to online services, noting that reports of software bugs are likely to increase as tools find them more quickly.

A serious set of vulnerabilities in PHP, a programming language used to power a large share of websites, triggered a global cyber-security alert after researchers used advanced artificial-intelligence tools to uncover flaws that had gone undetected for years. The weaknesses could let attackers take control of affected web servers without authentication and steal sensitive information. Experts warned that AI could make exploitation faster and that millions of websites may be affected. The discovery prompted organisations and governments to take precautionary action. Wikimedia, public bodies in Finland and Scotland, the BBC, and the Netherlands’ cyber-security agency were among those that temporarily took some websites or systems offline. Experts said smaller organisations with limited security resources could be particularly exposed, and predicted further attempts to exploit the flaws as technical details become public. PHP developers released patches, urging users to update immediately. The US National Security Agency advised organisations that could not patch at once to take affected systems offline, while the UK, EU, and Australian cyber-security authorities issued similar warnings. Japan’s prime minister also urged website operators to check whether their sites used PHP and consider suspending them if a prompt fix was not possible. Researchers said AI tools helped analyse complex code and identify long-standing bugs more quickly, but the episode also illustrates how AI could help attackers create offensive tools. Website operators are urged to install the latest PHP version, monitor vendor updates, and check for signs of compromise. Individual users should heed security advice from affected services and be cautious of phishing messages exploiting the incident.

Critical vulnerabilities in PHP, an open-source programming language used by many websites and web applications, have triggered urgent warnings from governments and a coordinated response from technology and cybersecurity companies. The flaws, collectively called “PHP2Shell,” could let attackers remotely execute malicious code on affected servers and potentially access sensitive data, file systems, and databases. Because PHP is widely used, the vulnerabilities may affect organizations across industries and countries, although not every PHP-based website is necessarily vulnerable. The U.S. National Security Agency urged organizations using PHP to prepare and apply security updates, advising them to take affected systems offline if they cannot update them promptly. The FBI and cybersecurity authorities in Singapore, the United Kingdom, Australia, Canada, and the European Union also issued warnings. Amazon said its MadPot threat detection system identified attempts to exploit the flaws before their public disclosure. The company said it did not know how the attackers learned of the vulnerabilities in advance. Google reported that its cybersecurity unit, Wiz, used AI models to help investigate the flaws, while Gemini assisted with assessing them, testing possible attacks, and verifying patches. OpenAI said researchers working with its AI models also helped uncover vulnerabilities and that it had spent two months coordinating with software maintainers, researchers, and security providers to prepare fixes and protective measures. Cloudflare said it had deployed web application firewall protections to block malicious requests targeting affected systems. The PHP development team has released security fixes, and authorities are urging website operators to identify affected versions and update quickly. The incident illustrates the broad risks posed by vulnerabilities in widely used software, as well as AI’s growing role in both discovering security weaknesses and potentially enabling their exploitation.

Two critical vulnerabilities in PHP, a programming language used by roughly seven in 10 websites, prompted governments and organisations across Europe to take websites and online services offline while they applied security updates. The flaws, present in PHP for more than a decade and affecting versions released over the past decade, could allow attackers to run code remotely without logging in. Patched releases are available, and CERT-EU warned that older versions should be considered exposed unless a vendor has supplied a backported fix. AI-assisted security research helped turn a previously suspected weakness into a working attack. Researchers from Calif, OpenAI and Wiz used advanced models and tools to identify and demonstrate attack methods. The PHP Foundation said its developers had noticed signs of the issue in 2024, but work on a fix stalled amid uncertainty and limited resources—a delay it described as a “structural failure.” After vulnerability identifiers and proof-of-concept material leaked online, PHP moved its release forward. Security experts warned that public technical details could make it easier for attackers to act quickly. The article stresses that taking a site offline does not itself mean it was hacked. The PHP Foundation said it found no functional exploit in the circulating proof-of-concept code at the time of release, although Cloudflare later reported attack traffic aimed at customers and CERT-EU warned that probing was more likely. Large organisations may patch quickly, but smaller businesses and user-run sites could remain vulnerable for longer. Potential consequences include hijacked sites, malware distribution, spam and stolen personal information being used in phishing. Third-party services can also leave an organisation exposed even after it patches its own systems. The article concludes that updating PHP is urgent, but effective cybersecurity requires multiple layers of defence.

Cloudflare recorded a rapid increase in attempts to exploit newly disclosed vulnerabilities in PHP, according to CEO Matthew Prince. The company saw thousands of attempts in the 10 hours before the vulnerabilities were publicly announced on Oct 21, rising to tens of thousands within 45 minutes, hundreds of thousands within two hours, and millions by the time Prince posted about the activity. PHP developers issued urgent fixes for flaws that had remained undiscovered for years and urged users to update immediately. The vulnerabilities were uncovered with the help of AI. Their disclosure prompted website operators and governments to take emergency steps to protect systems. Some government websites in Europe and elsewhere went offline. In Japan, Mitsubishi UFJ Financial Group temporarily suspended some internet services, while the Finance Ministry temporarily suspended some website content and services as security measures were implemented. Prime Minister Sanae Takaichi urged website owners to check whether their sites use PHP and prepare to apply the fixes. The article describes the immediate global response to the disclosure and the sharp rise in observed exploitation attempts, but does not specify the technical details of the flaws or report confirmed damage from the attacks.