AI Found PHP’s Hidden Flaw—Then the Internet Raced to Outrun It
AI Found PHP’s Hidden Flaw—Then the Internet Raced to Outrun It
Researchers at Calif and Google-owned Wiz began probing PHP in August with advanced AI tools, uncovering two critical flaws in the decades-old language that powers a huge share of the web. The bugs, collectively dubbed PHP2Shell, could let unauthenticated attackers run code on vulnerable servers, exposing data and allowing websites to be altered.
The discovery was initially framed as a defensive AI success. Researchers coordinated with the PHP Foundation and major security providers before disclosure, and emergency patches were prepared. But the very capability that helped identify the weaknesses sharpened the danger once details began circulating: Wiz warned that large language models can adapt exploits across PHP versions, configurations and memory layouts.
That tension erupted this week. A proof-of-concept video was briefly posted before the planned release, prompting the PHP Foundation to accelerate its patch rollout. Cloudflare detected thousands of exploit attempts before disclosure; within hours, the number surged through tens of thousands and hundreds of thousands to millions, according to its chief executive.
Governments and companies chose caution over continuity. Agencies in Finland, the Netherlands, Britain, Germany and Japan temporarily took services offline, while the NSA advised organizations unable to patch immediately to do the same. For residents, the outage made an abstract software flaw tangible: Helsinki developer Kalle Pusa said digital public services were so embedded in daily life that “a lot of the fabric could be said to have been torn.”
The disruption was especially punishing for older systems. PHP versions dating back roughly two decades were affected, yet many legacy sites cannot receive official updates; some operators faced temporary shutdowns, VPN workarounds or community-made backports. Still, the immediate picture remained contested: the PHP Foundation said it had no evidence of working exploits, while other researchers and cloud-security firms reported attempts and a rapidly escalating threat environment.
As operators patched, AI firms moved to turn the same technology into a cleanup tool. Aravind Srinivas said Computer was offering credits for checks that identify exposed PHP sites and prioritize fixes.
Write a comment