Major PHP Vulnerabilities Exploited Before Public Disclosure, Prompting Global Security Alerts

Image: Ars Technica · Source

Critical security flaws in PHP, discovered with AI assistance, were exploited by hackers days before being publicly disclosed. Major cloud and government entities urge immediate patches or system shutdowns to prevent widespread web attacks.

On October 22, 2026, cybersecurity warnings escalated globally following the discovery and exploitation of severe vulnerabilities in PHP, a foundational programming language powering about 70% of the world’s websites. Amazon, the world’s largest cloud computing provider, revealed that hackers began probing these PHP security flaws four days before the public was informed of their existence. The vulnerabilities, dubbed PHP2Shell, were identified with the assistance of AI models developed by OpenAI and Google, marking a significant intersection between artificial intelligence and cybersecurity.

The PHP vulnerabilities, which went undetected for over a decade, allow attackers potential direct access to servers’ file systems or databases without requiring passwords, effectively enabling full control over compromised web servers. Recognizing the critical threat, the US National Security Agency (NSA), UK National Cyber Security Centre (NCSC), and other authorities issued urgent advisories recommending immediate patching or, where not feasible, taking affected systems offline to prevent exploitation.

Researchers from the cybersecurity firms Calif and Wiz, the latter owned by Alphabet, collaborated with OpenAI and the PHP development team to confirm the flaws and roll out security patches on the day the vulnerabilities were publicly disclosed. OpenAI stated these bugs as “one of the most impactful security issues in recent memory” due to PHP’s widespread use, notably through platforms like WordPress, which rely heavily on the language.

The NSA emphasized the severity, warning that these vulnerabilities often grant a direct pathway into critical backend systems. Following this, some European governments reportedly took websites offline as they applied security updates. The White House also indicated that federal agencies were evaluating the vulnerabilities’ impact on government and critical infrastructure systems.

This incident underlines the dual-edged role of AI in cybersecurity: while AI helped detect the flaws before attackers did, the same technology can accelerate the development of sophisticated hacking tools. The event has intensified calls within both public and private sectors for vigilant cybersecurity practices and accelerated patch management especially for widely used internet technologies.

As organizations around the world rush to update their PHP installations, the episode stands as a stark reminder of the security risks embedded deep within internet infrastructure and the transformative potential of AI in identifying and responding to such risks.