For over ten years, critical security weaknesses remained hidden in a technology that supports a significant portion of the internet. These long-standing vulnerabilities were eventually identified with the help of artificial intelligence, triggering a worldwide cybersecurity response.
The issues were found in PHP, a widely used programming language that has played a major role in website development since the early 2000s. Following the discovery, governments and cybersecurity organizations across the globe advised website administrators to apply an emergency security update or, where necessary, temporarily take their platforms offline.
Cybersecurity company Wiz, whose researchers helped identify the flaws, described them as the most serious vulnerabilities ever uncovered with the assistance of AI. OpenAI, whose technology contributed to the discovery, also highlighted the significance of the issue.
What is PHP?
Although PHP may not be familiar to everyone, it plays an important role in many of the websites people use every day. PHP, short for PHP: Hypertext Preprocessor, is a free, open-source, server-side programming language used to develop websites and web applications. It runs on web servers and processes requests before sending the resulting content to a user's browser.
First introduced in the 1990s to support dynamic web pages, PHP continues to power a wide range of online services, from e-commerce platforms and Wikipedia to WordPress, the content management system used by millions of websites. Whenever someone visits a website powered by PHP, the language can process information, retrieve data, and generate the content displayed on screen.
PHP also supports frameworks and tools that simplify and accelerate application development. Popular examples include Laravel, Symfony, and Drupal, which help developers build and manage web projects more efficiently. PHP's continued development is supported by the PHP Foundation, a non-profit organization focused on the language's long-term sustainability.
What is the vulnerability?
Cybersecurity researchers and several organizations revealed two major vulnerabilities in PHP, warning that the flaws could pose a serious threat to websites and online services worldwide. Cybersecurity companies Wiz and Calif identified the issues, which were named php2shell. According to their findings, the weaknesses were embedded in the language itself and affected PHP versions released over the past decade.
Wiz explained that attackers could potentially exploit php2shell under certain conditions to gain control of vulnerable web servers and access confidential information. Artificial intelligence could further increase the speed and efficiency of potential cyberattacks, which is why the discovery raised concerns for websites and applications built using PHP.
What websites have been affected?
The cybersecurity warning triggered service disruptions across multiple countries, affecting gaming services, government websites, and internet forums. Among the organizations taking precautionary action was Wikimedia, the non-profit behind Wikipedia, which temporarily shut down several systems to reduce potential security risks.
Other affected services included websites operated by the Finnish government, Edinburgh City Council, and the BBC. The Netherlands' national cybersecurity agency also took its website offline as part of the response. Cybersecurity specialists warn that websites with outdated software or inadequate maintenance may face greater risk, particularly smaller organizations with fewer resources for strong security measures.
What followed the discovery of the vulnerabilities?
The PHP Foundation released emergency security updates to address vulnerabilities that had remained undetected in the software for several years. It urged users to install the latest updates without delay. Cybersecurity agencies and government authorities worldwide reinforced this message, advising website operators to take immediate steps to protect their platforms.
The US National Security Agency advised organizations to temporarily take affected systems offline if they could not apply the necessary security patches immediately. The UK's National Cyber Security Centre similarly urged organizations to update systems and inspect them for potential backdoors. Authorities across the European Union, Singapore, and Australia issued comparable warnings.
In Japan, Prime Minister Sanae Takaichi called on the public to verify whether publicly accessible websites were built using PHP. She emphasized that organizations unable to install the security patch quickly should consider temporarily shutting down websites or adopting other measures to minimize risk.
Technology companies also moved quickly to defend infrastructure against possible attacks. Amazon reported attempted exploitation before public disclosure while its websites continued to function normally. Cloudflare reported a sharp rise in attempted exploits after disclosure, highlighting how quickly attackers can react when details of a major vulnerability become public.
How did artificial intelligence play a role in the discovery?
Researchers from Calif and Wiz relied on sophisticated artificial intelligence tools to identify the vulnerabilities. These systems can examine complex software code and detect security weaknesses far more quickly than traditional methods or manual analysis. The underlying coding errors were not new; advances in technology made them easier to discover effectively.
The incident demonstrates AI's dual role in cybersecurity. It can help researchers identify previously overlooked weaknesses, but it can also enable malicious actors to develop attack tools and exploits more rapidly. Many security issues originate in older software development practices where functionality took priority over security, leaving modern systems exposed to risks that were not fully considered at the time.
What does this mean for you?
The vulnerability primarily affects back-end website operations, so most internet users are unlikely to notice a direct impact or need to take immediate action. However, small businesses and website owners, particularly those using platforms such as WordPress, should ensure their websites remain secure.
- Install the latest PHP security updates on every affected server.
- Contact your hosting provider or web development company to confirm the PHP patches are installed.
- Do not rely only on WordPress or plugin updates; the issue must be fixed in PHP itself.
- Consider temporarily taking vulnerable websites offline if patches or suitable temporary protections cannot be applied quickly.
- Monitor vendor and cybersecurity-agency advisories for new guidance.
- Remain alert for phishing emails or messages attempting to exploit public concern about the incident.
Website administrators carry the primary responsibility for applying updates, but ordinary users should follow security guidance issued by affected online services, including recommendations to change passwords where appropriate.
