A PHP vulnerability put the internet on the brink of mass compromise

A decade-old hole at the foundation of the web

This week, critical vulnerabilities were disclosed in the open programming language PHP, which, according to TechCrunch estimates, powers about 70% of websites, including the WordPress and Drupal content management systems — tens of millions of resources in total. Website owners were instructed to install updates immediately, or, if that was not possible, to temporarily take their sites offline. According to the publication, the vulnerability had existed in PHP for decades but remained unknown. It was discovered by human researchers as part of the OpenAI and Wiz (owned by Google) initiative called “Hack the Planet”, although AI was used to exploit the bug. The logic behind the urgent disclosure is this: if the vulnerability can be found with the help of large language models, attackers will be able to do the same, and a patch can only be rolled out by announcing the problem publicly.

The hacker race and the industry's response

The disclosure did not go smoothly: according to Sean O'Kane of TechCrunch, several people broke the embargo, which triggered a race among hackers. Cloudflare CEO Matthew Prince reported that attempts to exploit PHP2Shell had grown to the millions. Amazon, according to its blog, recorded attempts to exploit the vulnerability even before the public disclosure — using its own honeypot network. On TechCrunch's Equity podcast, O'Kane called the situation a “moment of reckoning,” noting that “at the bone level, the internet is held together with glue and dreams”. His podcast colleague Kirsten Korosec pointed out that most website owners, and even government resources, lack Amazon's resources for protection, and suggested that mass site shutdowns would lead to “link rot” — the loss of access to historical content.

Why it matters

The event affects virtually all owners of PHP-based websites — from small resources to government ones, which had to update or go offline at very short notice. The direct consequence is the need to install patches immediately and, in the view of the discussion participants, a rethinking of approaches to the security of the internet's open infrastructure, since with the spread of AI agents finding vulnerabilities like these will become easier. The editorial team notes a limitation: the actual scale of the damage from the attacks has not yet been disclosed in the publications.