The PHP2Shell vulnerability has triggered an international scramble to protect websites built with PHP, the programming technology used by more than 70 percent of the web. Two critical flaws could allow attackers to steal data or run code remotely without authentication, which is about as reassuring as it sounds.

PHP developers have released fixes, governments have temporarily taken services offline, and security companies have recorded millions of apparent exploitation attempts. As of October 22, however, no prominent website had publicly confirmed that PHP2Shell caused a successful compromise.

How did AI uncover the PHP flaws?

The discovery involved AI systems examining PHP for security weaknesses, followed by researchers validating and reporting what the models found. It was not a chatbot spontaneously deciding to rescue the internet during a quiet afternoon.

Cybersecurity company Wiz said its Atlas research system used Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol to identify the vulnerabilities. A separate researcher or group named Calif independently found a critical flaw using GPT-5.6 Sol through OpenAI’s Patch the Planet programme.

Wiz described the findings as among the most severe vulnerabilities in software history. OpenAI called the discovery “one of the most impactful security issues in recent memory”, while also acknowledging the obvious complication: AI can help defenders discover flaws, but it can also help attackers produce working exploits more quickly.

The episode also highlights a growing burden for the small, donor-funded operation maintaining PHP. AI tools can generate more vulnerability reports, leaving human maintainers to check which findings are genuine, assess their severity and produce fixes for software supporting an enormous share of the internet.

What can attackers do with PHP2Shell?

Wiz said the two vulnerabilities each received a severity score of 9.2 out of 10. Both involve memory-safety problems that could expose sensitive information or enable unauthenticated remote-code execution. In practical terms, an attacker may be able to make a vulnerable server run their commands without first logging in.

At least one flaw affects every PHP release issued over the past decade. Cloudflare said versions from PHP 5.4 onwards are affected.

PHP has released corrected versions:

  • PHP 8.2.35
  • PHP 8.3.36
  • PHP 8.4.27
  • PHP 8.5.12

Operators using affected installations must move to a fixed release. The United States National Security Agency advised organisations that could not patch immediately to suspend vulnerable services until they could be secured.

Did a leak give attackers a head start?

The coordinated disclosure was originally planned for October 22, but information about the vulnerabilities leaked on October 20. That forced researchers, infrastructure companies and PHP maintainers to accelerate their response.

Cloudflare enabled firewall protections for all customers at 03:02 UTC on October 21. The company said it detected attack traffic before the formal public disclosure and later observed attackers modifying their payloads to evade defences. Cloudflare chief executive Matthew Prince said the company had recorded millions of exploitation attempts.

Security firms watchTowr and Patchstack also detected attempts to target the flaws. WatchTowr said it had not observed a successful compromise, drawing an important distinction between someone trying a door and someone getting through it.

Early official assessments differed. The United States Cybersecurity and Infrastructure Security Agency, Canada’s cyber agency and Germany’s Federal Office for Information Security said they had no confirmed evidence of exploitation in the wild when they issued their notices. Those statements do not contradict reports of malicious traffic, but they show that attempted attacks had not yet produced publicly verified victims.

How have governments and website operators responded?

Government agencies, hospitals and schools in Europe took some websites offline while administrators installed patches or assessed their exposure. Japan also temporarily disabled government websites as a precaution.

Japan’s Chief Cabinet Secretary Minoru Kihara said the sites had been shut down “just to be safe”. Officials reported no related damage.

For most ordinary internet users, there is no PHP update to install on a phone or laptop. The immediate responsibility sits with website owners, hosting companies and server administrators. Users may still encounter unavailable services while those operators patch systems, review logs and check whether anyone arrived before the repairs did.