The PHP Foundation says its patches for the RCE vulnerabilities are limited to PHP 8.2 and newer, leaving legacy deployments dependent on third-party vendors
and how AI exposed itCasey Newton /Platformer:Introducing Machine GodsFinancial Times:Amazon warns new cyber flaws detected using AI are being ‘broadly exploited’pwn.watch:[critical] PHP2Shell: critical unauthenticated RCE in PHP coreLivemint:What to know about the AI-detected security bug impacting wide swaths of the internetEmily Forlini /Fortune:The PHP bug marks a dangerous new era for the internet. OpenAI's poised to cash inKim Jonghwa /The Asia Business Daily:[Reading Science] AI Uncovers
Context & Ripple Effects
The support gap follows the disclosure of PHP2Shell, a critical memory-management vulnerability that PHP’s creators said could affect up to 70% of websites. OpenAI said GPT-5.6 Sol found the flaws and expects comparable findings to rise sharply.
The Foundation’s version boundary turns vulnerability discovery into an operations problem: operators on older PHP releases cannot rely on the upstream patch path and must look to their third-party vendors.
First-order effects
- Legacy PHP operators face a split remediation path: upgrade to PHP 8.2 or newer, or wait for their vendor to supply a fix.
- Third-party vendors supporting older PHP deployments become the immediate patch bottleneck for customers exposed to the RCE vulnerabilities.
Second-order effects
- Hosting providers, appliance makers and managed-service vendors running legacy PHP must assess and distribute their own fixes, making support coverage a differentiator.
- OpenAI’s warning that AI-found vulnerabilities may increase sharply raises the cost of maintaining unsupported runtimes as security teams must triage more findings against constrained upgrade paths.
Third-order effects
- If AI-assisted discovery continues to surface severe flaws in mature infrastructure, software support lifecycles become part of the internet’s security perimeter rather than a back-office maintenance choice.
- The episode reinforces the dual-use code-intelligence dynamic: the same models that accelerate defensive discovery can compress the time vendors have to deliver patches across fragmented legacy estates.
The trend: AI-assisted code analysis is increasing the pressure on vendors and operators to retire unsupported software before vulnerability discovery outpaces patch distribution.
Related: Dual-use code intelligence · AI Commons as Critical Infrastructure · PHP · OpenAI · PHP2Shell vulnerability disclosure · OpenAI on AI-found PHP flaws
Related Coverage
- Usage statistics of PHP for websites W3Techs
- AI found a critical PHP flaw. The bigger failure began in 2024. The New Stack · Steven J. Vaughan-Nichols
- Scale of cyber-security flaw ‘unprecedented’ but no sign of breaches, says expert BBC
- What is PHP and why did it take government websites offline? Reuters · Leo Marchandon
- Critical PHP vulnerabilities threaten your NAS, not every vendor has a fix AppleInsider · Andrew Orr
- PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet Wiz
- The internet's hidden security nightmare — and how AI exposed it Axios · Herb Scribner
- Introducing Machine Gods Platformer · Casey Newton
- Amazon warns new cyber flaws detected using AI are being ‘broadly exploited’ Financial Times
- [critical] PHP2Shell: critical unauthenticated RCE in PHP core pwn.watch
- What to know about the AI-detected security bug impacting wide swaths of the internet Livemint
- The PHP bug marks a dangerous new era for the internet. OpenAI's poised to cash in Fortune · Emily Forlini
- [Reading Science] AI Uncovers a Critical Internet Vulnerability... Worldwide on Alert The Asia Business Daily · Kim Jonghwa
- South Korea Has 110,000 Hosts Vulnerable to Critical PHP Flaws ETNEWS
- PHP flaws draw millions of hacking attempts amid global push for fixes FCW · David DiMolfetta
- PHP2Shell: 22M exposed servers at risk as emergency patches released TechTarget · James Walker
- There's an internet-wide security crisis, but crypto might actually be ahead of the curve Yahoo Finance
- The Internet Is Currently On Fire Kotaku · Lewis Parker
- Critical security issue affecting PHP National Cyber Security Centre
- PHP security alert: What US and Indian government warnings mean for websites The Indian Express · Bijin Jose
- Critical PHP web security flaws spark global alarm as Google, OpenAI and Amazon respond CNBC · Jenny Lee
- PHP releases security fixes for two critical unauthenticated RCE vulnerabilities, affecting all web request-serving installations, and urges PHP users to update PHP
- AWS analysts say that at least one actor attempted to exploit the PHP2Shell vulnerabilities on October 17, four days before their public disclosure and patching Wired · Lily Hay Newman
- The PHP Foundation details how it found and fixed the two flaws, and says it had to release patches a day early after the two CVE IDs began circulating online The PHP Foundation
- Proof-of-concept exploit released for PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619) SOPHOS
- The entire internet is officially in crisis mode Polygon.com · Patricia Hernandez
- PHP's creators disclose a critical memory-management vulnerability, dubbed “PHP2Shell”, that affects up to 70% of websites, discovered via GPT-5.6 Sol in August Wall Street Journal · Robert McMillan
- This was my thought as well. It's important to patch, but this is significantly harder to trigger than the Ruby YAML thing (mentioned in this article) https://eliastaylor.com/... #php @Schneems@ruby.social · Richard Schneeman
- PHP releases security fixes for two critical unauthenticated RCE vulnerabilities, affecting all web request-serving installations, and urges PHP users to update PHP
- Japan to simulate cyberattacks as PHP flaws roil global internet Reuters
- PHP2Shell exposes the weakness in coordinated vulnerability disclosure InfoWorld · Taryn Plumb
- Here's how to protect your information from the PHP flaw, according to cybersecurity pros Business Insider · Truman Dickerson
- OpenAI says ChatGPT Sol helped uncover critical PHP flaws that could affect 70% of websites Tom's Hardware · Etiido Uko
Discussion
-
@jacobshap
Jacob L. Shapiro
on x
I'm a little confused here Is the story, omg, AI can find vulnerabilities and hack all of our systems and the internet is dying Or, wow, AI can find vulnerabilities we didn't know of and help patch them quickly, making us all safer in the long run https://www.wired.com/...
-
@m_jones_1797
@m_jones_1797
on x
This is rather serious. About 70% of websites rely on PHP, which has been discovered to contain 2 major vulnerabilities. Cybersecurity specialists Cloudflare report thousands of attempts to exploit the vulnerability. Thankfully patches are available. https://www.ncsc.gov.uk/...
-
@vlad_mihalcea
Vlad Mihalcea
on x
Simplicity and flexibility always win. That's why PHP has a 80% market share of all Internet websites. https://w3techs.com/... [image]
-
@danjarvismbe
Dan Jarvis MP
on x
Do you want more information about how to protect your organisation following the PHP advisory notice? The UK's cyber experts at @NCSC have published six key steps for organisations - large or small - to follow today. https://www.ncsc.gov.uk/...
-
@sporadica
@sporadica
on x
wait, if my math is correct.. doesn't this say that a full ONE THIRD of the Internet is just...perma-fucked?
-
@intcyberdigest
@intcyberdigest
on x
The day the internet broke, and most of it is too old to fix.
-
@mondoab
@mondoab
on bluesky
“The PHP Foundation has revealed two serious vulnerabilities that could impact millions of websites. Security experts warn that failure to quickly patch the flaws could have dire consequences.” — www.wired.com/story/this-i...
-
@charles.littlegreenfootballs.com
Charles Johnson
on bluesky
I spent most of the day upgrading and patching stuff on several sites. — ‘This Is Not a Drill’: Critical PHP Vulnerabilities Are Setting the Internet on Fire
-
@mattburgess1
Matt Burgess
on bluesky
“Updating is the only safe choice” — As PHP releases the details of its critical vulnerabilities, governments around the world are taking their websites offline for updates. — Security researchers warn things could be real bad if systems aren't patched immediately — Story w…
-
r/BetterOffline
r
on reddit
Did LLMs' reward hacking behavior just cause a huge number of hours of cybersecurity labor to be expended for no good reason?
-
r/theprimeagen
r
on reddit
There isn't an easy exploit for this PHP vulnerability
-
r/ReverseEngineering
r
on reddit
There isn't an easy exploit for this PHP vulnerability
-
r/ItalyHardware
r
on reddit
Ma che è successo a mezzo internet oggi?
-
r/technology
r
on reddit
‘This Is Not a Drill’: Critical PHP Vulnerabilities Are Setting the Internet on Fire
-
@ollieatnowhere
Ollie Whitehouse
on x
At the @NCSC we are asking all UK organisations and their supply chains across product and services to understand their use of PHP and prepare to patch... https://www.ncsc.gov.uk/...
-
@ncsc
@ncsc
on x
The NCSC is encouraging UK organisations to prepare for immediate updating of systems using PHP. Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated. For more⬇️ https://www.ncsc.gov.uk/...
-
@thorchrs
@thorchrs
on bluesky
👇🇬🇧"Minister says 32 UK government services unavailable due to global cyber-security issue" — #UnitedKingdom #PHPVulnerability
-
r/wallstreetbets
r
on reddit
Critical security issue affecting PHP | National Cyber Security Centre
-
r/anime_titties
r
on reddit
PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet
-
r/cybersecurity
r
on reddit
Wiz got pre-auth RCE on WordPress, Drupal and Joomla through vulnerabilities in PHP itself
-
r/GeminiAI
r
on reddit
Gemini 4 Argon credited for “invaluable contributions” to PHP2Shell vulnerability discovery
-
@jeremy_kirk
Jeremy Kirk
on x
Wiz on PHP2Shell: “With frontier AI models and the right tools, a single researcher completed in a week what previously would have taken a world-class team months of work.” https://www.wiz.io/...