PHP: The three little letters wreaking havoc across the web
Two critical vulnerabilities in PHP, dubbed PHP2Shell, have put a vast portion of the internet at risk, leading to temporary shutdowns for major sites and permanent closures for older services.
Intelligence analysis by Gemini 2.5 Flash
A widespread security flaw in the PHP programming language, present for nearly two decades, has been made easily exploitable by powerful AI models, causing significant disruption across the web. Websites from Wikipedia to government agencies and old mobile games have been affected, with many struggling to patch unsupported older versions of PHP.
Imagine the internet is like a giant city built with lots of different kinds of LEGO bricks. PHP is a super common type of brick used for almost all the buildings. Now, imagine someone found a tiny, hidden crack in this common brick that's been there for 20 years, but it was super hard to find. Suddenly, a super-smart robot brain (AI) figured out how to easily use that crack to make buildings fall down. So, many websites, like your favorite online games or places where people share art, had to close temporarily to fix their buildings before they crumbled, and some old ones might even disappear forever.
Analysis
PHP2Shell
The PHP2Shell vulnerability represents a critical security flaw that has existed within the PHP programming language for approximately 20 years. This long-standing bug, previously considered exceptionally complex to exploit by human researchers, has now become a significant threat due to advancements in AI. The vulnerability's severity is rated at 9.2 out of 10, prompting cybersecurity agencies like the NSA and UK's National Cyber Security Center to recommend taking systems offline if immediate updates are not feasible.
The widespread impact of PHP2Shell stems from PHP's pervasive use across the internet, powering an estimated 70 percent of websites, including major platforms like Wikipedia, WordPress, and Drupal. The exploit has forced numerous sites, including DeviantArt, 4Chan, and even the Internet Archive, to temporarily shut down. For many older websites and services built on unsupported PHP versions, patching is not an option, leading to permanent shutdowns and the potential loss of significant portions of internet history.
GPT-5.6 Sol
Intriguingly, the article highlights the dual-edged sword of AI in cybersecurity, specifically mentioning GPT-5.6 Sol. This OpenAI model was reportedly used by a security researcher at Calif to proactively identify the critical PHP exploits before malicious actors could widely leverage them. This demonstrates AI's potential as a powerful tool for defensive cybersecurity, capable of uncovering complex vulnerabilities that might otherwise remain hidden or be too difficult for human analysis alone.
However, the same article also notes that powerful AI models have simultaneously made it significantly easier to turn such obscure bugs into dangerous, widely exploitable vulnerabilities. This suggests that while AI can aid in discovery and defense, it also lowers the barrier for exploitation, creating a more volatile threat landscape. The involvement of AI in both identifying and facilitating the exploitation of PHP2Shell underscores a new era in cybersecurity where AI plays a central, complex role.
Cloudflare
The global content delivery network and cybersecurity company Cloudflare experienced a direct and intense impact from the PHP2Shell exploit. CEO Matthew Prince reported a dramatic escalation in attack attempts across their network. In the 10 hours prior to the public disclosure of the vulnerability, Cloudflare observed thousands of exploitation attempts.
Following the public announcement, the volume of attacks surged rapidly, jumping to hundreds of thousands within two hours and reaching millions by the following night. This rapid increase in malicious activity underscores the immediate and widespread threat posed by PHP2Shell once it became public knowledge. Cloudflare's experience serves as a stark illustration of the scale and speed at which such critical vulnerabilities can be weaponized across the internet, necessitating rapid response and patching efforts from infrastructure providers.
Key points
- Two critical vulnerabilities, collectively known as PHP2Shell, have been discovered in the PHP programming language, affecting up to 70% of websites.
- The flaws have existed for approximately 20 years but have become easily exploitable due to powerful AI models.
- Major websites like Wikipedia, WordPress, Drupal, DeviantArt, 4Chan, and even government agencies were impacted, with some forced to temporarily shut down.
- Older websites and services running unsupported PHP versions face permanent shutdown as they cannot be patched.
- OpenAI's GPT-5.6 Sol was reportedly used by a security researcher to identify the PHP exploits proactively, highlighting AI's dual role in cybersecurity.
The proactive use of AI, specifically GPT-5.6 Sol, by security researchers to identify the PHP vulnerability before widespread malicious exploitation demonstrates AI's potential to enhance defensive cybersecurity measures. This could lead to faster discovery and patching of critical flaws, improving overall internet security.
The fact that powerful AI models have made a previously obscure, 20-year-old bug easily exploitable suggests a concerning future where AI could accelerate the weaponization of vulnerabilities. This could lead to more frequent and severe internet disruptions, especially for older, unmaintained systems.
