A critical bug in PHP, found using AI, forced governments offline. Patches were rushed out, but working exploits may have been created within hours.
Follow the storyPHP4 stories
01Summary
- 01The vulnerability, dubbed PHP2Shell, allows unauthenticated remote code execution on PHP servers.
- 02Researchers at Calif and Google's Wiz discovered the bug using AI models including GPT‑5.6 Sol and Gemini 4 Argon.
- 03The PHP Foundation released patches 24 hours early after a proof-of-concept video leaked.
- 04Matt Suiche of Tolmo said his team coded a working exploit in under a day using AI.
- 05Two years ago, a similar flaw was reported to the PHP Foundation but no fix was issued, which the foundation called a 'structural failure'.
02Why it matters
Millions of websites, including many government sites, use PHP. If your data was hosted on a vulnerable server, attackers may have stolen it without your knowledge, and you might never find out.
Pulse AIAsk about this story
Answers are generated by AI from the story summary; they are not investment, health or legal advice.
