A pair of critical flaws in PHP, the programming language that runs an estimated 70% of websites, set off a global patching scramble this week after researchers showed the bugs could hand attackers control of servers without a password.
The flaws were found using OpenAI models, working alongside security firms Wiz and Calif. The group nicknamed the bug set PHP2Shell. One of the flaws had sat in the language for 14 years.
What the flaw allows
Attackers could take over affected web servers without authentication and read memory that may hold passwords and session data. Because PHP sits under WordPress, Drupal and a long list of custom sites, the exposure reaches hospitals, retailers and government portals, not only technology companies.
Wiz compared the severity to Heartbleed, the 2014 encryption bug that exposed data across much of the web. Researchers said the flaw is hard enough that it sits at the edge of what human analysts could exploit, and easy for an AI agent that can run attack steps on its own.
Who told organisations to act
The US National Security Agency and the European Union's cybersecurity agency advised immediate patching. Both said systems that cannot be updated quickly should be taken offline. Some European government sites did exactly that, and parts of their public services went dark for a day.
Cloudflare's chief technology officer, Dane Knecht, said the company saw early attack attempts before the patch became public. OpenAI released a tool administrators can run to check whether an installation is exposed.
Why the disclosure was rushed
Details leaked online this week, forcing PHP's maintainers to publish the advisory and the update earlier than planned. That shortened the gap between warning and exploitation, which is the gap defenders rely on most.
The episode cuts both ways. AI found a bug that years of human review missed, and the same capability can help attackers write exploits faster. Security teams now face a simple test: patch, or disconnect.