PHP Foundation urges updates as AI exposes flaws in 70% of websites

AI-driven security research has uncovered two critical vulnerabilities in PHP, the programming language that serves as the backbone for approximately 70% of the world’s websites. Known as "PHP2Shell," these flaws allow attackers to gain unauthorized control over affected servers, prompting a global rush to secure digital infrastructure. Security firms Wiz Research and Calif, who identified the vulnerabilities using advanced AI models, have warned that the flaws remained undetected for over a decade.

The discovery has triggered significant disruptions as governments and corporations scramble to implement emergency patches. In the United Kingdom, Tech Minister Baroness Lloyd confirmed that 32 government services were taken offline as a precautionary measure while security updates were implemented. Similar actions were seen in Australia, Finland, and the Netherlands, where official portals were temporarily deactivated to prevent potential breaches. High-profile entities like Wikimedia also moved to secure their systems, while Japan’s Prime Minister and China’s industry ministry issued urgent warnings to web administrators to audit their systems immediately.

Experts have compared the severity of these vulnerabilities to the 2014 "Heartbleed" bug, describing them as some of the most critical in software history. The US National Security Agency (NSA) advised organizations to take vulnerable sites offline entirely if they could not be patched immediately. While preliminary reports suggest that active exploitation remained minimal in the initial hours, some firms reported millions of automated attempts to target the flaws shortly after the announcement. The PHP Foundation noted that an early announcement was necessary due to a social media leak, even as they finalized official security updates.

This event highlights a significant shift in the cybersecurity landscape, as AI is now being used to expose long-standing flaws in foundational internet code. While the immediate focus remains on patching, the scale of the potential impact on the vast majority of the internet has reignited debates over the security of aging software infrastructure. Organizations worldwide are now being urged to prioritize immediate updates and enhance long-term monitoring as the interplay between AI and cybersecurity continues to evolve.