PHP is the programming language behind roughly 70% of websites, and it just ran into a serious problem. Security researchers used AI to uncover a critical flaw called PHP2Shell, which could let attackers take over web servers, steal data, or disrupt online services. Since the discovery, websites worldwide have been hit with millions of attempts to exploit it.
Hackers moved fast once the flaw went public. Cloudflare CEO Matthew Prince said the attack attempts jumped from tens of thousands within 45 minutes to millions overnight, The Guardian reports.
How did AI find the PHP flaw and why is it causing so much alarm?
If PHP sounds unfamiliar, it’s a decades-old language running WordPress, Wikipedia, Slack, Drupal and more. Cybersecurity firm Calif spotted the flaw with help from a large language model on August 1. Wiz found it too, using its own AI tool alongside Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol.
According to Wiz, the bug sat buried for over a decade and was nearly impossible for humans to exploit because it required an unusually complex chain of steps. However, AI changed the math real quick by lowering a barrier that wouldn’t have been easy for human coders.
The NSA has warned that attackers could hijack servers, steal sensitive data, and burrow deeper into networks. Now governments and companies are yanking sites offline to patch them before hackers strike. The PHP Foundation released a security patch on Wednesday. Authorities have urged organizations to apply it immediately or temporarily take affected systems offline.
How websites around the world are going dark
In the UK, authorities took 32 government services offline as a precaution, while the National Cyber Security Centre sent 50,000 alerts to affected organizations. Former NCSC chief Ciaran Martin called it the most serious vulnerability in five years.
Wikipedia, the Internet Archive, and 4Chan reportedly went down too, along with government sites in the Netherlands, Germany, Kenya, and France. Japan’s Prime Minister Sanae Takaichi also urged businesses to patch or shut down, while South Korea activated emergency measures.
Meanwhile, schools, charities, and local governments without security teams face the biggest risk. The NCSC says some older systems can’t be patched at all and will need replacing. If your site runs on PHP, patch it now and check for signs of unauthorized access.
RELATED COVERAGE:
- Apple patched an iPhone flaw attackers may already have exploited. Here’s how the attack works
- Google Chrome’s new early warning system could help you spot scam sites
- AI is finding Apple security flaws faster than Apple can sort through them
- Wikipedia says rogue OpenAI agents attacked its platforms and hammered its servers
- OpenAI AI agents bombarded the United Nations with aggressive tactics to extract data
