PHP2Shell Flaws Trigger Global Cybersecurity Response

Authorities in Europe, Asia and elsewhere have taken some government websites temporarily offline after researchers identified two critical vulnerabilities in PHP, a programming language used by a large share of websites. The US National Security Agency issued a rare public warning, advising organizations to update affected systems immediately or take websites offline until they can be patched. Germany, France, Belgium, the Netherlands, Finland and the Czech Republic reported taking websites offline or applying security measures. Japan’s Prime Minister Sanae Takaichi also warned about the risk on social media. The vulnerabilities, collectively dubbed PHP2Shell, were discovered with assistance from artificial intelligence tools. Researchers at Calif, working with OpenAI, reported one flaw on August 11; Wiz, an Alphabet-owned security firm, reported the other on August 24. Wiz described the findings as among the most severe vulnerabilities found in PHP and said the underlying flaws had existed for decades. Demonstrating how to exploit them required a sequence of steps that had been difficult for human researchers to accomplish. The flaws involve unauthorized access to portions of computer memory. An attacker could use them to run commands remotely on a server using vulnerable PHP code, without a password or legitimate account. The nonprofit PHP Foundation called the vulnerabilities among the most severe it had encountered and urged website administrators to update their code immediately. The Foundation also warned that AI could make security weaknesses easier to find, benefiting both defenders and attackers. It called for technology companies to coordinate their response to reduce the risk of major disruption to online services, noting that reports of software bugs are likely to increase as tools find them more quickly.

A serious set of vulnerabilities in PHP, a programming language used to power a large share of websites, triggered a global cyber-security alert after researchers used advanced artificial-intelligence tools to uncover flaws that had gone undetected for years. The weaknesses could let attackers take control of affected web servers without authentication and steal sensitive information. Experts warned that AI could make exploitation faster and that millions of websites may be affected. The discovery prompted organisations and governments to take precautionary action. Wikimedia, public bodies in Finland and Scotland, the BBC, and the Netherlands’ cyber-security agency were among those that temporarily took some websites or systems offline. Experts said smaller organisations with limited security resources could be particularly exposed, and predicted further attempts to exploit the flaws as technical details become public. PHP developers released patches, urging users to update immediately. The US National Security Agency advised organisations that could not patch at once to take affected systems offline, while the UK, EU, and Australian cyber-security authorities issued similar warnings. Japan’s prime minister also urged website operators to check whether their sites used PHP and consider suspending them if a prompt fix was not possible. Researchers said AI tools helped analyse complex code and identify long-standing bugs more quickly, but the episode also illustrates how AI could help attackers create offensive tools. Website operators are urged to install the latest PHP version, monitor vendor updates, and check for signs of compromise. Individual users should heed security advice from affected services and be cautious of phishing messages exploiting the incident.

Two critical vulnerabilities in PHP, an open-source programming language used to power websites and web applications, have prompted urgent security warnings worldwide. Known collectively as “PHP2Shell,” the flaws could allow attackers to execute malicious code remotely on affected servers and potentially access sensitive data, server file systems, and databases. Although not every website running PHP is necessarily vulnerable, its widespread use has raised concerns about the possible scale of attacks. The U.S. National Security Agency advised organizations using PHP to prepare and apply security updates, and recommended taking affected systems offline if updates cannot be installed promptly. The FBI and cybersecurity authorities in Singapore, the United Kingdom, Australia, Canada, and the European Union also issued warnings. Amazon said its threat intelligence team had detected attempts to exploit the vulnerabilities before they were publicly disclosed. The company’s MadPot system monitors suspicious activity across internet-facing infrastructure. Amazon said it was not yet clear how the attackers learned about the flaws in advance. Google and OpenAI described how AI tools assisted vulnerability research and response. Google said its Wiz cybersecurity unit used AI models to investigate the issues, while Gemini helped assess the flaws, test possible attacks, and verify patches. OpenAI said researchers working with its models helped uncover vulnerabilities and that it had coordinated for two months with software maintainers, researchers, and security providers to prepare fixes. The company characterized the flaws as among the most significant security issues in recent memory, while also noting the risk that similar AI capabilities could be misused by cybercriminals. Cloudflare said it had deployed web application firewall protections to block malicious requests. PHP’s development team released security fixes, and authorities urged website operators to check affected versions and update quickly. The episode highlights the broad risks created by vulnerabilities in widely used software and the growing role of AI in both finding and addressing them.

Cloudflare recorded a rapid increase in attempts to exploit newly disclosed vulnerabilities in PHP, according to CEO Matthew Prince. The company saw thousands of attempts in the 10 hours before the vulnerabilities were publicly announced on Oct 21, rising to tens of thousands within 45 minutes, hundreds of thousands within two hours, and millions by the time Prince posted about the activity. PHP developers issued urgent fixes for flaws that had remained undiscovered for years and urged users to update immediately. The vulnerabilities were uncovered with the help of AI. Their disclosure prompted website operators and governments to take emergency steps to protect systems. Some government websites in Europe and elsewhere went offline. In Japan, Mitsubishi UFJ Financial Group temporarily suspended some internet services, while the Finance Ministry temporarily suspended some website content and services as security measures were implemented. Prime Minister Sanae Takaichi urged website owners to check whether their sites use PHP and prepare to apply the fixes. The article describes the immediate global response to the disclosure and the sharp rise in observed exploitation attempts, but does not specify the technical details of the flaws or report confirmed damage from the attacks.