AI discovery of decades-old PHP flaws triggers precautionary global website shutdowns
Government agencies, media organizations, and enterprise IT teams around the world took thousands of public websites and digital platforms offline following the emergency disclosure of two critical, decades-old vulnerabilities in the PHP programming language. Dubbed "PHP2Shell," the severe flaws impact the core memory management and error handling of a language that powers roughly 70% of the global web, enabling unauthenticated remote code execution (RCE) on vulnerable servers.
The emergency response intensified after details of the embargoed vulnerabilities leaked online prematurely, forcing the PHP Foundation to rush out security updates as threat actors launched millions of automated exploitation attempts.
Decades-Old Memory Flaws Discovered via Frontier AI Models
The vulnerabilities sit deep within the underlying PHP runtime architecture, affecting core code logic that has remained largely untouched for over 20 years. Rather than being uncovered through conventional manual auditing, the flaws were identified after security researchers utilized frontier AI models, including Anthropic's models and OpenAI's Patch the Planet framework, to systematically analyze legacy open-source codebases.
The flaws allow remote, unauthenticated attackers to corrupt server memory via malformed web requests, providing a direct execution path to underlying server file systems and connected databases without needing passwords or session tokens.
Because the vulnerabilities exist inside PHP's native memory management and error handling layers, modifying individual website code, themes, or application-level plugins is insufficient; the underlying PHP runtime must be updated.
National Security Agency (NSA) warned that the flawed logic trace extends back to legacy releases including PHP 5, putting millions of enterprise servers at risk.
Precautionary Outages Across Public Sector and Media Infrastructure
Given the severity of the flaws and the sudden zero-day exposure window created by the early information leak, global cyber defense agencies, including the UK's National Cyber Security Centre (NCSC), Japan's NISC, and the NSA, issued clear "patch or pull" operational directives.
Organizations unable to immediately deploy runtime patches were advised to temporarily disconnect affected infrastructure from the public internet. The advisory triggered widespread precautionary shutdowns across multiple sectors:
Government Digital Services: Public portals and official websites across Canada, France, Germany, Belgium, the Netherlands, Finland, and the Czech Republic went dark temporarily while infrastructure teams applied and verified security patches.
Major Knowledge and Media Hubs: The Wikimedia Foundation took down non-essential internal systems as a precaution, while portions of the Internet Archive and web services hosting various public broadcasts briefly experienced access disruptions.
Financial Services: Enterprise entities, including Japan's Mitsubishi UFJ Financial Group, restricted or suspended select web-facing portals during mitigation.
Automated Exploitation and Long-Term Infrastructure Patching
Within hours of the emergency disclosure, cloud security providers reported a massive surge in malicious activity. Infrastructure network Cloudflare recorded millions of automated exploitation attempts per minute targeting internet-exposed PHP servers, with Amazon Web Services noting that decoy honeypots had detected scanning activity shortly before public release.
While the PHP Foundation shipped patched builds for active branches (PHP 8.2 and PHP 8.3), administrators face a massive operational task upgrading legacy environments that rely on end-of-life versions.
The incident highlights both the power and peril of AI-driven vulnerability discovery, demonstrating how advanced AI tools can surface deeply hidden flaws in foundational open-source code, while leaving digital infrastructure exposed to rapid exploitation if defensive patching cannot keep pace.
