Credit: Gina Silverstein. AI-generated photo concept.
When I heard the news a few weeks ago about a flaw in PHP, a programming language widely used on the Internet, like any good spy novel, it conjured questions about who the good and bad guys were. As it turned out AI was aiding and abetting both. Several months before, cybersecurity experts discovered a critical entry point in PHP scripting that allowed the remote execution of malicious code for tampering and spying on data. Dubbed PHP2Shell, it is more of a cataclysmic crack than a minor gap, affecting an estimated 70% of government, public, and privately owned sites worldwide, and hundreds of millions of users. It is considered by Wiz, one of the cybersecurity experts that uncovered it, as “among the most severe vulnerabilities discovered in PHP, and arguably in software history.” Websites built on PHP include all WordPress, Joomla, and Drupal sites, and an entire ecosystem across the clouds including hosting providers, independently managed servers, content delivery networks, and other apps.
To make matters worse, while international security teams worked on a solution with the help of AI (the good guys), the critical vulnerability was apparently leaked before a coordinated announcement was to be made and a patch released. Hackers, likely with the help of their own AI (the bad guys), began attempting to use it to break into systems. First traced by Amazon’s AWS on October 17, it was described as “being broadly exploited in the wild.” Other companies, such as Cloudflare, also tracked the threats.
“In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.”
Researchers from cybersecurity firms Wiz and Calif, using AI model GPT-5.6 Sol, are credited with discovering the vulnerability, which had been hidden in the PHP codebase for more than a decade. For several months they analyzed, tested, and validated a patch using a team of AI helpers—Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol—in a compressed time frame that humans alone could not have accomplished due to the complexity. Working with OpenAI, Google, Automattic, Microsoft, Cloudflare, PHP, and other cross-industry companies, they came up with a framework for guidance and mitigations. After the leak, on October 21, PHP rushed the release of the emergency patch updates they had been working on.
What you can do:
Immediately contact your developer, cybersecurity expert, or IT provider if you haven’t heard from them. The vulnerability affects all versions of PHP code from 5.4 to the latest 8.5 release. Corporations, governments, healthcare, and other organizations with sensitive data, e-commerce, and a high volume of online traffic should be especially proactive in updating to ensure security. Companies with small footprints may not have immediate threats but should install the updated version as soon as possible. This includes sites and blogs built with WordPress, Joomla, and Drupal, or migrated from a PHP application—for example WooCommerce to Shopify—which may still have residue code. The caveat is that the updates won’t fix PHP releases older than 8.2 so users are advised to upgrade to a supported version with the patch. It also won't address the underlying vulnerabilities in connected systems so it also advised to check if the hosting provider, operating system vendor, or container image vendor has also supplied the necessary updates.
Please note that this post is provided for informational purposes and should not be construed as complete advice. You should conduct due diligence and contact an expert with any questions or concerns you may have.
Unauthorized use and/or duplication of this material without express and written consent from this website’s author and/or owner is prohibited. Excerpts and links may be used, provided that full and clear credit is given to the author and www.ginasilverstein.com.