NEWS · CODING · #2422
Critical PHP vulnerabilities (PHP2Shell) disclosed, widely exploited after AI-aided discovery
Researchers disclosed two critical vulnerabilities in the PHP programming language — reportedly present for about 20 years — which security firm Wiz says became practically exploitable after AI-assisted work. The flaws have triggered widespread exploitation attempts (Cloudflare reported millions of hits), forced many sites and services offline, and prompted guidance from the NSA and UK NCSC to take systems offline if they cannot be immediately patched.
KEY POINTS
- Researchers disclosed two critical vulnerabilities in the PHP programming language — reportedly present for about 20 years — which security firm Wiz says became practically exploitable after AI-assisted work.
- The flaws have triggered widespread exploitation attempts (Cloudflare reported millions of hits), forced many sites and services offline, and prompted guidance from the NSA and UK NCSC to take systems offline if they cannot be immediately patched.
- This matters because PHP underpins a large share of the web, many affected installations are old/unsupported and hard to patch, and AI has lowered the bar to turning obscure long‑standing bugs into large-scale exploits.
WHY IT MATTERS
This matters because PHP underpins a large share of the web, many affected installations are old/unsupported and hard to patch, and AI has lowered the bar to turning obscure long‑standing bugs into large-scale exploits.