Critical 'PHP2Shell' vulnerability threatens up to 70% of websites
Creators of PHP disclosed a critical memory-management flaw dubbed 'PHP2Shell', which was discovered using AI and threatens up to 70% of websites worldwide.
PHP's creators have disclosed a critical memory-management vulnerability dubbed "PHP2Shell" that affects the core engine of the programming language powering roughly 70% of the world's websites, according to a Wall Street Journal report by Robert McMillan and security research from Wiz Research. The flaw was initially discovered in August using GPT-5.6 Sol, marking a significant case of artificial intelligence uncovering a major web security defect.[1][3][7][9]
The vulnerability enables remote code execution and could allow attackers to hijack unpatched web servers, steal sensitive information, and launch attacks against site visitors. Described as PHP's most severe security issue in over a decade, it has drawn comparisons to the historic Heartbleed bug. Prominent platforms and services associated with the PHP threat include WordPress, Wikipedia, and the Internet Archive.[2][6][8][9]
Cybersecurity teams are racing to deploy fixes amid warnings that AI tools could allow malicious actors to produce operational exploits in seconds. Remediation efforts rely heavily on open-source contributors, as highlighted by The Atlantic's Charlie Warzel in an interview with Ondrej Sury, a volunteer maintainer who helps automate PHP patches and addressed two critical vulnerabilities during the crisis.[4][5][7][8]
Key facts
- PHP's creators disclosed a critical memory-management vulnerability named 'PHP2Shell' that affects up to 70% of websites worldwide.
- The vulnerability was discovered in August using the AI model GPT-5.6 Sol.
- The bug could permit attackers to hijack unpatched servers, exfiltrate sensitive data, and target website visitors.
- The flaw has been described as PHP's most severe issue in over a decade and compared to Heartbleed.
- Platforms cited in connection with the security threat include WordPress, Wikipedia, and the Internet Archive.
- Ondrej Sury, a volunteer maintainer who automates PHP patches, worked on fixing two critical PHP vulnerabilities.
Sources · 7 sources
- TE
Techmeme@TechmemePost on X ·
PHP discloses a critical memory-management vulnerability, dubbed "PHP2Shell", that affects up to 70% of websites, discovered using GPT-5.6 Sol in August (@bobmcmillan / Wall Street Journal) (Visit Techmeme dot com for the link and full context!)
Open source - ET
Economic Times@EconomicTimesPost on X ·
#WordPress, #Wikipedia and More: The #PHP #SecurityThreat Explained 🔗 https://t.co/GCICvXLVQU https://t.co/CvA1QSJNxB
Open source - TN
The New Stack@thenewstackPost on X ·
PHP powers roughly 70% of the world’s websites, according to Wiz Research, so a flaw in its core engine affects https://t.co/CDncjxbpY3
Open source - TE
TechmemeArticle ·
An interview with Ondřej Surý, a volunteer who maintains and helps automate PHP patches, about his role in fixing two critical PHP security vulnerabilities (Charlie Warzel/The Atlantic) Charlie Warzel / The Atlantic : An interview with Ondřej Surý, a volunteer who maintains and helps automate PHP patches, about his role in fixing two critical PHP security vulnerabilities — On Tuesday, the world found out about two massive security vulnerabilities in PHP, a programming language that is used by roughly 70 percent of websites.
Open source - TE
Techmeme@TechmemePost on X ·
An interview with Ondřej Surý, a volunteer who maintains PHP and automates its patches, about his role in fixing two critical PHP security vulnerabilities (@cwarzel / The Atlantic) (Visit Techmeme dot com for the link and full context!)
Open source - TE
TechRadar@techradarPost on X ·
PHP security crisis —here's the full list of major websites affected so far, from Wikipedia to the Internet Archive https://t.co/SRm0ftW8Q8
Open source - TE
TechmemeArticle ·
PHP's creators disclose a critical memory-management vulnerability, dubbed "PHP2Shell", that affects up to 70% of websites, discovered via GPT-5.6 Sol in August (Robert McMillan/Wall Street Journal) Robert McMillan / Wall Street Journal : PHP's creators disclose a critical memory-management vulnerability, dubbed “PHP2Shell”, that affects up to 70% of websites, discovered via GPT-5.6 Sol in August — AI tools helped find one of the most severe online bugs ever. Cyber experts are racing to patch it before hackers use AI to exploit it.
Open source - CB
Coin Bureau@coinbureauPost on X ·
🚨ALARMING: Up to 70% of the world's websites could be at RISK after AI researchers uncovered PHP2Shell, a CRITICAL security flaw in PHP, the WSJ reports. The vulnerability could allow hackers to hijack unpatched servers, steal sensitive information and launch attacks against website visitors. Security teams are RACING to deploy patches as experts warn that AI could help hackers develop working exploits in SECONDS. Described as PHP's most severe security issue in over a DECADE, the flaw is drawing comparisons to Heartbleed, one of the biggest cybersecurity crises in internet history.
Open source - 阳明
阳明AI@x_autonomyPost on X ·
【AI热点】18:00-00:00 更多详细信息→https://t.co/p1sqd8Qtct 1. Wiz Research披露PHP2Shell：AI助攻PHP核心RCE漏洞，影响全球70%网站 [影响大·可执行高] 2. Wiz披露LiteLLM PyPI包供应链攻击，恶意版本v1.107.0窃取凭据 [影响大·可执行高] 3. 中国商务部AI技术出口管制新规草案解读 [影响大·可执行低]
Open source