Governments and companies rush to patch systems after discovering flaws in PHP affecting 70% of websites
Category: Science
In a dramatic turn of events, a coalition of researchers has uncovered multiple severe vulnerabilities in PHP, a programming language that powers approximately 70% of the websites on the internet. Dubbed PHP2Shell, these vulnerabilities could allow attackers to take control of servers, steal sensitive data, and deface websites. The urgency of the situation has prompted governments and companies worldwide to take immediate action to patch their systems, with many briefly shutting down services as a precaution.
The vulnerabilities identified by Wiz Research, OpenAI, and Calif include memory disclosure and unauthenticated remote code execution (RCE) in PHP itself, which is independent of the applications built on it. This means that even if an application is secure, it can still be compromised if it runs on a vulnerable version of PHP. The flaws affect every PHP version released in the last decade, dating back to version 5.4, making the potential impact widespread.
In response to the vulnerabilities, the U.S. National Security Agency (NSA) and cybersecurity agencies across Europe have advised immediate action. Websites, including those of government agencies in Germany, France, Belgium, the Netherlands, Finland, and Japan, were temporarily taken offline to implement security patches. For example, the popular Irish news site, The Journal, was also briefly offline as it bolstered its defenses against potential attacks.
World leaders, including Dutch Prime Minister Rob Jetten and Japanese Prime Minister Sanae Takaichi, have publicly urged organizations to take these vulnerabilities seriously. Takaichi stated, "Please check if your publicly available websites use PHP, and prepare to apply the fix patch that will be released tonight... as soon as possible," highlighting the urgency of the matter.
The discovery of these vulnerabilities marks a notable moment in cybersecurity, as artificial intelligence significantly aided the identification and exploitation of long-standing flaws in the PHP codebase. Researchers at Wiz noted that "AI changed the ability to understand the weaknesses and turn them into a working exploit." By utilizing frontier AI models, they were able to complete in a week what would have previously taken a world-class team months of work.
AI tools enabled researchers to test a larger number of attack vectors than was previously feasible, illustrating both the potential for AI to aid defenders and the risk it poses in the hands of attackers. The PHP Foundation acknowledged that the vulnerabilities are among the most severe it has encountered and warned that AI would make such weaknesses easier to find, stating, "Tools now find bugs faster than ever, for defenders and attackers alike, and the number of reports will keep growing."
The implications of these vulnerabilities are vast. If successfully exploited, attackers could gain unauthorized access to servers running vulnerable PHP versions, potentially leading to data breaches and service disruptions. The vulnerabilities allow for remote code execution without requiring authentication, meaning that even simple applications could be at risk. The PHP Foundation has reported that the flaws could lead to unauthorized access to sensitive information, including passwords and authentication tokens.
Wiz Research has highlighted the severity of these vulnerabilities, ranking them among the most severe discovered in PHP and possibly in software history. The underlying flaws had been present for decades, but demonstrating their exploitability required a complex series of steps that were only made feasible through AI-assisted analysis.
The PHP Foundation has released a patch to address these vulnerabilities, and all organizations using PHP are urged to apply the updates immediately. The patch was made available on October 21, 2026, coinciding with public disclosure of the vulnerabilities. Security experts recommend that organizations prioritize upgrading to the fixed PHP versions to mitigate the risks associated with PHP2Shell.
In addition to applying patches, organizations should monitor for suspicious activity, particularly unusual multipart requests and large or malformed PHPSESSID response cookies, which may indicate attempts to exploit these vulnerabilities. AWS and other security firms have advised that upgrading is the only complete remediation and that there are no configuration-only workarounds that fully address the issues.
The PHP2Shell vulnerabilities underline a shift in the cybersecurity threat environment, particularly how AI is changing the dynamics of vulnerability discovery and exploitation. Amazon Threat Intelligence reported that attempts to exploit PHP2Shell began as early as October 17, 2026, just days before the public disclosure, indicating that some actors may have gained access to exploit information before the official announcement. This points to the need for organizations to be proactive in their cybersecurity measures and to assume that vulnerabilities may be exploited before they are publicly disclosed.
As AI continues to advance, the time from patch to working exploit is shrinking, meaning that organizations must adapt their security strategies accordingly. Security leaders are now advised to measure patch and mitigation timelines in hours rather than days, as the window for effective response is narrowing.
This incident serves as a wake-up call for the tech community and organizations relying on PHP, emphasizing the importance of timely updates and the need for a coordinated response to vulnerabilities that can have far-reaching consequences. As the PHP Foundation stated, "The opportunity is to make this work routine: systematically finding flaws in existing software and catching new ones before they reach production." With AI playing an increasingly central role in both discovery and exploitation, the cybersecurity community must remain vigilant and proactive in addressing these challenges.