AI discovers critical security flaw in PHP, halting websites across Europe

Summary

Two AI models, independently of OpenAI and Google, discovered two critical command execution vulnerabilities in PHP, known as 'PHP2Shell,' with a CVSS score of 9.2. This led European governments, hospitals, and universities to take their websites offline as a precautionary measure until a patch was released.

Why it matters

PHP supports approximately 70% of server-side web traffic and underpins platforms like WordPress, Drupal, and Joomla. Consequently, a vulnerability in this common foundation has a massive impact scope across the public sector and critical infrastructure. The incident also serves as a concrete example of AI reducing the effort required to find such flaws from months of work by a global research team to a single researcher’s weekly process, fundamentally changing the speed at which vulnerabilities are discovered and exploited.

Highlights

• The security flaws had existed in PHP code for over 10 years. The PHP Foundation noted in 2024 that it had spotted signs but failed to resolve the issue due to resource and decision-making shortcomings, describing it as a 'structural failure.'
• Wiz stated that AI lowered the threshold for turning this vulnerability into an attack tool. Cloudflare observed early-stage attack attempts within hours of the patch being made public.
• Sensys data indicates that approximately 1.5 million of the 2.6 million observed hosts are running PHP versions past their end-of-support date, meaning they cannot receive the official patch and remain vulnerable indefinitely.

Critical take

While the headline suggesting AI found the error is appealing, the article itself acknowledges that the vulnerability has existed for a decade and that the PHP team has been partially aware of it since 2024. AI accelerated the discovery but was not the source of the underlying engineering debt. Furthermore, CISA did not report any confirmed exploitation cases at the time of publication. Some affected countries (Germany, Finland) also explicitly stated that their decision to take websites offline was precautionary. These details soften the narrative of an active, large-scale attack.