Governments and companies rushed to secure internet-facing systems after researchers uncovered critical vulnerabilities in PHP, a programming language used by nearly 70% of websites with known server-side programming languages, highlighting how artificial intelligence is accelerating the discovery and exploitation of software flaws.
The vulnerabilities, dubbed “PHP2Shell,” could allow unauthenticated attackers to remotely execute code on affected servers, potentially exposing sensitive corporate and government data. Authorities and cybersecurity experts urged organisations to install security patches immediately or take vulnerable systems offline.
The U.S. National Security Agency issued a warning shortly before emergency fixes were released on Wednesday, as government websites across Europe were taken offline as a precaution. Cybersecurity firm Cloudflare subsequently reported millions of attempts to exploit the vulnerabilities.
The incident underscores growing concerns that artificial intelligence tools are shortening the time between the discovery of a software vulnerability and its potential exploitation, leaving organisations with less time to secure systems before attackers move in.
Matt Suiche, a researcher at cybersecurity startup Tolmo, said the urgency surrounding the vulnerabilities was unprecedented.
“That’s not something that even existed a year ago,” he said. “The reason there is that sense of urgency now is really because everyone has AI-augmented capabilities, not only defenders but also attackers.”
PHP, created in the 1990s, is widely used to build and operate websites and web applications. Its extensive deployment means vulnerabilities affecting internet-facing installations can expose a broad range of organisations to potential attacks.
Researchers from AI firm Calif and Google’s Wiz identified the vulnerabilities in mid-August. Calif’s researchers used OpenAI’s GPT-5.6 Sol, while the Wiz team used its Wiz Atlas security AI agent, Google’s Gemini 4 Argon and GPT-5.6 Sol.
The PHP Foundation had planned to release patches on Thursday, but details of the vulnerabilities emerged earlier in online forums and through a proof-of-concept video accidentally published by Calif on Tuesday. The video demonstrated how the flaws could be chained together to execute an attack.
The foundation accelerated the release of security fixes by 24 hours, making them available at 10 a.m. ET on Wednesday. By then, code purporting to exploit PHP2Shell had already appeared on GitHub, the software development platform owned by Microsoft.
Elizabeth Barron, executive director of The PHP Foundation, said that the organisation was “diligently monitoring the situation,” but noted that there was currently no “evidence of any working exploits, only incomplete, misguided, and non-working generated ones.”
Suiche, however, said his team at Tolmo had developed a working exploit in less than a day.
“With AI, it was relatively quick to have a local reproduction,” he said, adding that before today’s powerful AI models, producing it would have taken his team “multiple weeks”.
Amazon Threat Intelligence reported that it had identified a PHP2Shell exploitation attempt on Saturday through its MadPot telemetry network, which monitors attempts to connect to digital decoys designed to attract and detect malicious activity.
LONG-STANDING SECURITY WEAKNESS
The vulnerabilities also exposed shortcomings in the processes used to maintain widely deployed open-source software.
Mihail Kirov, a product security engineer at Tolmo who previously worked at Quarkslab, said he had been part of a team that identified a vulnerability with the same underlying cause two years ago.
Kirov said The PHP Foundation had been notified of the earlier flaw, but a fix was never implemented. The foundation acknowledged in a blog post on Wednesday that the delay represented a “structural failure, caused by both the security team’s decision process and its lack of resources.”
Researchers at Calif subsequently identified two vulnerabilities, each rated 9.2 out of 10 on a scale measuring security severity.
“They proved that today, in 2026, using large language models, things can go really, really fast,” Kirov said, about the Calif team. “One of the reasons for that is that LLMs allow you to explore so many different angles.”
The vulnerabilities highlight the challenge of maintaining security across software that has been deployed for decades, particularly where operators lack the resources or expertise to update legacy systems regularly.
Suiche said government agencies and municipal authorities could be particularly exposed because some continue to operate websites built years ago without sophisticated security protections.
He said that city governments and other agencies often use PHP and “haven’t updated their website in 10 years.”
“Those people have a lot of critical data,” he said.
ATTACKERS MOVING FASTER
Security experts warned that even organisations that apply patches might struggle to determine whether attackers had accessed their systems before the fixes were installed.
Neatsun Ziv, CEO of cybersecurity provider Ox Security, said organisations without application security platforms already in place could lack the visibility needed to identify suspicious requests targeting their servers.
Suiche said companies might discover a breach only after stolen information surfaced elsewhere.
He said a company would only know it was hacked if its valuable data was “being sold later on the dark web.” He said that’s the “reality of yesterday and is still the reality of today.”
The episode comes amid growing industry concern over advanced AI systems that can assist with vulnerability discovery and cyberattack development.
Anthropic, the creator of the Claude AI assistant, made its Mythos model available in April to a limited group of companies and government agencies to assess its cybersecurity implications before any broader release.
Ziv said the time required for attackers to identify and exploit a new vulnerability across internet-connected systems had fallen sharply.
“The amount of time that it takes the bad guys, the threat actors, to actually find a new exploit and run it on the entire internet used to be weeks,” Ziv said. “It went down to days, and starting in the Mythos age, from April 2026, it went down to hours.”
Stay ahead of the Stories shaping our world. Subscribe to Impact Newswire and join our
WhatsApp Channel for updates on global tech, business, and innovation—all in one place.
Dive deeper into the future with the Cause Effect 4.0 Podcast, where we explore the ideas, trends, and technologies driving the global AI conversation.
Got a story to share? Contact Us to reach a global audience with Impact Newswire.
Mohd Hassan has extensive experience in news gathering, editing, and writing for the newswire industry, Contact – Info@impactnews-wire.com
Discover more from Impact Newswire
Subscribe to get the latest posts sent to your email.
