AI-discovered PHP flaws dubbed PHP2Shell force government websites offline worldwide

Government websites across Europe and beyond went offline on Wednesday after the disclosure of two critical flaws in PHP, the programming language behind most of the world’s websites, in what experts fear could become one of the largest software emergencies in years.

The flaws, collectively dubbed PHP2Shell, could allow attackers to remotely execute malicious code on affected servers without logging in, or read sensitive information held in server memory. Google-owned security firm Wiz said its researchers uncovered the bugs using AI tools, while OpenAI said security firm Calif independently found one of them using an OpenAI model.

PHP’s developers released emergency fixes on Wednesday and urged all users to “update immediately”. Sites taken offline as a precaution included Japan’s Finance Ministry, the US HR platform BambooHR, the Port of Rotterdam and the Wikimedia Foundation, which operates Wikipedia. Japan’s prime minister, Sanae Takaichi, posted on X urging website owners to “check whether your live site uses PHP and prepare to apply the new fix.”

The exposure is enormous: internet intelligence firm Censys says about 1.5 million of 2.6 million hosts report running a PHP version with no fix. “All servers using any version of PHP released in the last 20 years will be vulnerable,” said Tiffany Farriss of the Drupal Association. Costin Raiu of TLP:Black warned that AI was powering a “race to exploit”, and the next step could be the “mass compromise of every vulnerable web server on the internet.”