AI-discovered PHP flaws force governments and companies worldwide to take websites offline
Researchers using AI tools from Calif, Wiz and OpenAI discovered two critical PHP vulnerabilities, dubbed PHP2Shell, affecting roughly 70% of websites. The NSA, UK NCSC, EU and Australian agencies urged immediate patching or taking systems offline. Governments and organizations in Finland, the Netherlands, Germany, France, Belgium, Australia, the UK and elsewhere shut down services as a precaution. PHP released emergency patches on October 21, but hundreds of thousands of servers on unsupported versions remain exposed, and early exploitation attempts have been reported.
IllustrationEditorial responsibility
- No named human review is recorded for this page.
- Reports are grouped by semantic similarity and deterministic rules. Language models may assist titles, summaries, translation and cross-source analysis; the page reads the event directly, while its address stays stable when the title changes.
- Summary covers the current reports
Cross-source coverage
Common ground
- The reporting on this event has real problems: the bug's age is disputed, the exposure numbers mix different groups, and 'no known exploits' contradicts 'attacks observed before patches.'
- A public registry of critical infrastructure dependencies is a good idea, because right now nobody is required to know where vulnerable systems run.
- Open-source maintainers who keep critical code alive should be funded, since patching is a real and fixable problem.
- The AI-discovery angle is less important than the underlying failure of who maintains and governs critical infrastructure.
Points of contention
- Western Agent says the core story is political power and who owns the plumbing of democratic life; Neutral Agent says the core story is a countable maintenance failure with 758,000 end-of-life servers.
- Western Agent argues discovery capability is concentrating in private labs and state actors; Neutral Agent says discovery is already distributed and the real scarce thing is disclosure norms.
- Western Agent treats 'fix what you can count' as a way of avoiding the deeper argument; Neutral Agent treats it as the only actionable path.
- Western Agent says the absence of a public address list is itself the scandal; Neutral Agent says it means the stakes are still unproven.
Blind spots
- Neither side could name a specific hospital or system running the vulnerable software, so the real-world stakes remain asserted rather than shown.
- Both sides focused on the United States and Western infrastructure, with little attention to how this affects other regions.
- Neither side seriously addressed who would pay for the registry, the audits, or the maintainer funding they both support.
- The discussion treated 'AI found it' mostly as a headline, without examining how AI tools actually change bug discovery in practice.
WorldAttention’s read
The roundtable agreed that the reporting on this event is messy and that the AI angle is overhyped. The real fight is between two frames: Western Agent's view that this is a power story about who owns and governs critical infrastructure, and Neutral Agent's view that it is a maintenance story about countable, fixable failures. They found common ground on a public registry of critical dependencies and on funding open-source maintainers. But they never resolved whether discovery capability is concentrating dangerously or whether the real problem is voluntary disclosure. The most honest takeaway is that nobody currently has to know where the vulnerable systems are, and that is the gap both sides want closed.
Reporting timeline
Critical PHP Security Flaw Forces Global Websites Offline
A critical security vulnerability in the widely used web programming language PHP prompted government agencies and companies worldwide to take websites offline as a precaution. The US NSA and Germany's BSI urged immediate patching or shutdowns, warning that hackers could gain direct access to servers and databases without passwords. The flaw, affecting all PHP versions up to at least PHP 5, was reported in August by Calif and OpenAI, with further exploits found by Wiz. Websites in Germany, France, the Netherlands, Belgium, and Australia were affected, including police portals, the Charité hospital, and Wikipedia. A security update was released Wednesday, but BSI Vice President Thomas Caspers warned that those who fail to patch face imminent risk, and consumers should expect possible malware from compromised sites in coming days.
Read sourceGovernments scramble to patch PHP flaws after AI-discovered cyber warning
The UK government said it is working to identify potential exposure in its online services after critical cyber-security flaws were found in the PHP programming language, which underpins a large share of the world's websites. Governments and major companies including Amazon rushed to protect systems before hackers could exploit the flaws, which were first discovered by AI. Amazon said it detected a 'PHP2Shell exploitation attempt' on 17 October and further attacks on 21 October, occurring after details leaked on social media but before an embargo on the warning was lifted. The UK's NCSC, along with EU and Australian counterparts, urged PHP users to apply fixes or take systems offline. The Dutch cybersecurity agency went offline as a precaution, Finland shut down public web services, and Wikipedia took down parts of its site. Wiz estimated roughly 70% of the internet is affected, a figure the BBC could not independently verify.
Read sourceNSA warns of critical PHP2Shell flaws, urges patching or taking servers offline
The NSA and authorities in Europe, Asia and other regions warned of newly identified security vulnerabilities in PHP, the programming language powering most websites online. The NSA told organizations to patch two critical flaws, dubbed PHP2Shell, or pull unpatched servers offline. Both bugs live in PHP's core, so every installation serving web requests is at risk regardless of the site running on top. When a request exhausts memory or hits a fatal error, PHP can leave half-built or freed memory that cleanup code or later requests trust. On Apache's mod_php, a demonstrated exploit triggers corruption before any application code runs, so logins and app-level checks cannot block it. Cloudflare observed attacks before PHP shipped fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21. VirusTotal counts about 5.1M IP addresses running PHP, and about 758K on end-of-life branches with no patched release, a long tail that will determine how long PHP2Shell stays exploitable.
Read sourceShow 6 older updatesHide older updates
The NSA just told companies to pull their websites offline if they can't patch them right away. The reason is a bug that's been sitting in the code behind 70% of websites for 14 years. Last
The NSA advised companies to take websites offline if they cannot immediately patch a PHP vulnerability that has existed in code behind roughly 70% of websites for 14 years. Dan Lorenc, CEO of security firm Chainguard, found the flaw in one evening by prompting an AI with "find bad vulnerabilities in PHP." Calif had already found it on August 1 using OpenAI's GPT-5.6 Sol, and Wiz later found it with Gemini and GPT. OpenAI, Wiz, Calif and PHP maintainers quietly built a fix. After bug IDs leaked and an exploit video was posted by mistake, PHP moved its release up a day; Chainguard shipped its fix over six hours early, citing active attacks and decoy servers catching IPs from China and Russia. VirusTotal counted about 758,000 exposed servers on unsupported PHP versions 5.4 through 8.1, versus roughly 272,000 on supported versions, leaving no patch for about three in four.
Read sourceAI Uncovers PHP Flaws Sparking Global Cyber-Security Emergency Response
Long-undetected vulnerabilities in the PHP programming language, which underpins much of the internet including Wikipedia and WordPress, were exposed by AI tools from security firms Calif and Wiz, prompting a rare global cyber-security alert. Governments and agencies worldwide, including the US National Security Agency, UK National Cyber Security Centre, and EU and Australian counterparts, urged website operators to patch immediately or take systems offline. Wikimedia, the Finnish government, Edinburgh council, the BBC, and the University of Geneva were among those taking services down. PHP developers released emergency patches. Researchers warned the flaw could let attackers seize servers without authentication and steal data, with exploitation attempts likely to rise as technical details become public. OpenAI, whose technology helped find the flaws, called it one of the most impactful security issues in recent memory.
Read sourceCritical PHP Flaws Found by AI Prompt Global Website Shutdowns
International governments and cyber-security agencies urged organisations to patch two critical vulnerabilities in PHP, the programming language powering much of the internet, after a fix was issued on Wednesday afternoon. The flaws, discovered by AI tools from firms Calif and Wiz under OpenAI's Patch the Planet programme, had gone undetected for over a decade. Wiz called them the most severe vulnerabilities ever discovered by AI and estimated roughly 70% of the internet is affected, a figure the BBC could not verify. Finland shut down government public web services, the Netherlands' cyber-security agency and parliament lower house took sites offline, and the US NSA advised organisations unable to patch to take systems offline. The Wikimedia Foundation, Edinburgh council, and BBC programme pages including Doctor Who were also affected. CERT-EU warned of potential unauthenticated remote code execution, and Cloudflare reported early attacks emerging.
Read sourceAI Uncovers Decades-Old PHP Flaws Threatening Millions of Websites
The U.S. National Security Agency issued an urgent warning on Wednesday about two critical vulnerabilities in PHP, a server-side language powering roughly 70% of websites. The flaws, present since PHP 5 in 2004, allow attackers to infiltrate file systems or databases. Patches have been released by the PHP Foundation, and the NSA advises unpatched sites to go offline. The vulnerabilities were discovered using AI: OpenAI's GPT-5.6 Sol found one flaw through its 'Patch the Planet' initiative, while Google's Wiz used its Atlas security AI agent, Gemini 4 Argon, and GPT-5.6 Sol to find multiple holes. Both organizations followed responsible disclosure and worked with PHP on patches. OpenAI states the flaws were found before hackers exploited them, partly because they were previously too hard to exploit. However, Wiz warns that AI now lowers this barrier, enabling adaptation of exploits to different PHP versions. With disclosure public, a race is on to patch tens of millions of sites before attacks occur.
Read sourceAI Researchers Find Critical PHP Flaw Affecting 70% of Websites
Researchers using GPT-5.6 Sol discovered critical vulnerabilities in PHP, the software running about 70% of websites, according to AI security firm Calif. The flaws, which score 9.2 on the CVSS severity scale and affect PHP versions as old as 5.4, could let attackers without accounts take over web servers. PHP rushed out fixes, and a leak of the CVE numbers forced the release a day early. Cloudflare reports early attack attempts. Calif called them the most severe vulnerabilities ever discovered by AI, if not in all of software history. Auditors spotted the weakness in 2024, but the fix stalled for months partly because no practical attack had been shown. Wiz, a cloud security company now owned by Google, said the models let one researcher finish in a week what once took a top team months.
Read sourceCritical PHP Flaw Discovered by AI Triggers Global Website Shutdowns
A critical remote code execution vulnerability in the PHP programming language, reportedly discovered using AI, has led to websites being taken down worldwide. According to Wiz.io, the flaw, dubbed PHP2Shell, affects up to 70% of the Internet. The Guardian reports that the flaw in PHP has caused a shutdown of websites around the world. Reuters notes that government websites have gone dark following the AI-discovered flaw, sparking a security scramble. Cloudflare has deployed protections against the php2shell vulnerability. A critical cyber-security update has been issued in response.
Read source