Ahmed Kamel – Egypt Daily News
A pair of critical vulnerabilities in PHP, the programming language used by a large share of the world’s websites, has prompted urgent patching by companies and government agencies. The episode is also a vivid example of how artificial intelligence is changing cybersecurity: AI-assisted research helped uncover long-standing weaknesses, while the same capabilities could make it easier for attackers to take advantage of flaws before organizations update their systems.
The PHP project released security updates on October 21, warning that the vulnerabilities could allow attackers to run code on affected servers without first logging in. The weaknesses were grouped under the name “PHP2Shell.” Security agencies and technology providers have urged organizations that operate PHP-based services to install the fixes promptly. Where an immediate update is not possible, agencies recommend limiting public access to exposed systems until they can be patched and checked.
The risk is potentially broad because PHP is widely used to build and operate websites and web applications. It is part of the technology behind major content-management systems, including WordPress and Drupal, as well as many custom services. A vulnerability in the language itself can therefore affect organizations that may not realize PHP is running behind a website or included in a product they depend on.
Reports of disruptions have already emerged. Some government agencies and businesses temporarily took websites or online services offline while they applied updates or assessed exposure. The Wikimedia Foundation said it had taken some systems down as a precaution while addressing the vulnerabilities. Organizations may also need time to test updates against their own applications and software dependencies, making it possible for interruptions to continue even after fixes become available.
The PHP project published corrected versions of its supported release branches: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Organizations running older, unsupported versions should contact their software or hosting provider to determine whether security fixes are available. Updating PHP itself may not be enough if a website relies on a bundled product, a third-party package or a managed hosting service. Administrators need to establish which systems are affected, verify that the relevant update has been applied, and confirm that the service is running the corrected version.
The vulnerabilities had not suddenly appeared in the code. The PHP Foundation said concerns about one issue had surfaced during security work in 2024, but researchers had not then established a practical way to exploit it. More recent research, conducted by multiple security teams, demonstrated the seriousness of the flaws and helped maintainers prepare fixes before the public disclosure. The foundation acknowledged that the delay in addressing the earlier warning reflected shortcomings in its security process and limited resources.
AI played a part in that research. OpenAI said a security team working with its models identified a critical flaw, while researchers at Wiz reported independently discovering both vulnerabilities. The researchers and PHP maintainers coordinated their work to test fixes and prepare a public release. The process illustrates a potential advantage of AI-assisted security research: tools that help investigators examine complex software can surface risks that might otherwise remain hidden.
But the timing of disclosure matters. Once a vulnerability becomes public, attackers can study the information and search for systems that have not been updated. Security firms reported a rapid surge in attempted attacks after details began circulating. The precise scale and impact of those attempts remain difficult to determine from outside the affected organizations, but experts say the period between disclosure and patching is especially dangerous.
The issue also raises concerns about how widely advanced AI tools may be used. The same technology that helps defenders analyze software could help attackers develop or adapt harmful techniques. That does not mean every AI-discovered vulnerability will be exploited, nor that every PHP website is compromised. It does mean organizations cannot assume that a flaw will remain obscure while they wait to act.
A further PHP vulnerability was disclosed on October 23, adding to the need for administrators to follow current guidance from the PHP project and their software vendors. Security teams should treat notices as an ongoing process rather than a single update: check affected versions, apply relevant fixes, review provider advisories, and monitor systems for signs of unusual activity. If administrators suspect a breach, they should follow their organization’s incident-response procedures and seek qualified assistance.
The wider lesson is that finding a vulnerability is only the beginning of the response. Maintainers must develop fixes that do not break essential software; vendors must package and distribute them; and organizations must identify every affected system and install updates. AI may accelerate discovery, but protecting the internet still depends on coordinated, timely work by the people who build and operate its underlying software.
