AI Exposes PHP Flaws Threatening 70% of Websites as Exploitation Attempts Surge Into Millions
Updated
Updated · The Guardian · Oct 23
AI Exposes PHP Flaws Threatening 70% of Websites as Exploitation Attempts Surge Into Millions
3 articles · Updated · The Guardian · Oct 23
Summary
Decades-old PHP vulnerabilities found with AI have triggered warnings of a coming “vulnerability tsunami,” with experts saying defenders may be unable to patch critical systems fast enough.
70% of internet sites may be at risk because PHP underpins millions of websites, and researchers said the flaws had existed for years but were too complex for humans to prove exploitable.
Millions of exploitation attempts were seen after disclosure, Cloudflare said, up from thousands in the 10 hours before announcement to tens of thousands within 45 minutes and hundreds of thousands within two hours.
US and UK government and private sites temporarily went offline to patch, while the NSA urged all PHP users to update immediately, warning attackers could steal data, disrupt services or move deeper into networks.
Tech leaders including Sam Altman, Marc Benioff and Cloudflare’s Matthew Prince said AI will both uncover and weaponize software bugs at unprecedented speed over the next two years.
If AI can uncover decades-old flaws like php2shell in seconds, is the internet's legacy infrastructure doomed to a continuous vulnerability tsunami?
With millions of end-of-life PHP servers exposed to a single anonymous request, how can organizations survive this unprecedented AI-weaponized cyber threat?
The 2026 PHP2Shell Emergency: AI Uncovers Decade-Old Flaws Impacting 70% of Websites
Overview
In October 2026, AI-powered research teams Wiz and Calif uncovered critical memory-safety flaws in PHP’s core runtime, enabling unauthenticated remote code execution across millions of websites. After researchers disclosed the vulnerabilities, active exploitation was detected before the PHP Foundation could release emergency patches. The embargo collapsed following leaks and early exploit demonstrations, prompting a rushed global response. Governments and enterprises took systems offline, while providers like Cloudflare deployed emergency defenses. Advanced AI models rapidly synthesized complex exploits, shrinking the grace period between disclosure and mass attacks from weeks to minutes. This crisis exposed deep structural weaknesses in open-source security and forced a new, urgent approach to vulnerability management worldwide.