PHP2Shell Crisis Exposes Fragile Web Infrastructure in the AI Era
A decades-old PHP flaw affecting roughly 70% of websites triggered emergency patches, site shutdowns and millions of hack attempts, exposing AI-era cyber risks.
Summary
Website owners were told to patch immediately or take sites offline after severe vulnerabilities emerged in PHP, or Hypertext Preprocessor, the decades-old open source language underpinning WordPress, Drupal and roughly 70% of websites, representing tens of millions of sites. Human researchers participating in OpenAI and Google-owned Wiz’s Hack the Planet initiative discovered the vulnerabilities, then used AI to exploit the bug. AI did not find it.
Some participants apparently moved ahead of the coordinated disclosure, accelerating attackers’ race to exploit PHP2Shell. Cloudflare CEO Matthew Prince said activity escalated to millions of attempted hacks, while Amazon’s honeypot network detected exploitation before the public announcement. Governments and popular websites briefly went offline to patch, but smaller organizations and underfunded government sites face prolonged shutdowns, link rot and lost historical material. OpenAI’s disclosure rollout and promotional tone drew criticism, though quietly notifying every affected operator was impractical. Widely available large language models and autonomous agents could accelerate future discovery and exploitation of similarly old flaws, threatening websites, banks, data and privacy. The response may create demand for security startups and open source defenses from companies such as Nvidia.
Positives
- Human researchers in OpenAI and Wiz’s Hack the Planet initiative identified the PHP vulnerabilities before widespread damage was confirmed.
- Amazon’s honeypot network detected exploitation before public disclosure, demonstrating the value of well-funded defensive monitoring.
- Emergency guidance gave website operators a clear choice: patch immediately or take vulnerable sites offline.
- Google, OpenAI, Wiz, Cloudflare and Amazon supplied research or telemetry that helped expose and track the threat.
- New security startups and open source defenses from companies such as Nvidia could emerge in response.
Risks & concerns
- PHP underpins WordPress, Drupal and roughly 70% of websites, exposing tens of millions of sites to potential compromise.
- Cloudflare CEO Matthew Prince said PHP2Shell activity escalated to millions of attempted hacks.
- Amazon detected exploitation before public disclosure, indicating attackers had early knowledge of the vulnerability.
- Governments, popular websites and smaller operators faced shutdowns, link rot and possible loss of historically valuable online material.
- Large language models and autonomous agents could scale discovery and exploitation of decades-old software flaws.
- Banks, data and privacy may face growing risks, while underfunded organizations lack Amazon-level security resources.