Hackers Had Four-Day Head Start on Epic PHP2Shell Flaw
Hackers were already probing the critical PHP2Shell bug before defenders were notified, as Amazon and government agencies warn of widespread exploitation.
Radwan AbdulhadiEditor and technology writer
Global Alert Issued Over PHP Vulnerabilities
Amazon warned that severe vulnerabilities in a programming language underpinning much of the Internet are being broadly exploited as governments and companies scramble to secure their systems. According to <a href="https://arstechnica.com/security/2026/10/hackers-got-a-four-day-head-start-on-epic-php2shell-vulnerability/">Ars Technica</a>, the world's largest cloud computing provider reported on Wednesday that it identified an attempt by hackers to exploit the bug four days before the weakness was disclosed to the public.
The US National Security Agency and UK authorities warned earlier on Wednesday that the vulnerabilities left websites around the world critically exposed to hacking. Reports indicated that some European governments were taking sites offline while patching the two security flaws.
The NSA advised all organizations utilizing the programming language known as PHP to immediately update their systems or take them offline. The NSA stated that these vulnerabilities often provide a direct path to the server's file system or database.
Discovery via AI and Widespread Impact
The vast impact of the bugs stems from their discovery with the help of OpenAI and Google models after remaining undetected for more than a decade. This highlights the ability of AI to upend cybersecurity. Researchers at two US cybersecurity groups, Calif and Wiz, discovered the vulnerabilities, with Alphabet-owned Wiz estimating that the compromised programming language powered about 70 percent of all websites worldwide.
OpenAI noted the exceptional severity of the situation, stating that given the flaws and PHP's widespread use, it considers this one of the most impactful security issues in recent memory. OpenAI added that to its knowledge, frontier AI found these vulnerabilities before attackers did.
The AI lab also noted that the situation highlights how AI can uncover security flaws with Internet-scale impact, while acknowledging that the same capabilities can help attackers rapidly develop offensive tools and exploits. OpenAI worked directly with PHP, Calif, and Wiz to verify the vulnerabilities and develop the necessary patches.
Ecosystem Reach and WordPress Reliance
The massive footprint of PHP across the Internet is largely driven by WordPress, the most widely used website-building platform, which is written primarily in PHP and relies heavily on it to function properly.
The developers responsible for maintaining PHP released software updates to patch the vulnerabilities on Wednesday. However, the UK's National Cyber Security Centre warned that the flaws could potentially allow a hacker to take control of a website's server without requiring a password or other login credentials. The NCSC encouraged UK organizations to take immediate action.
The White House announced that federal agencies were actively assessing the potential impacts of the bugs on government systems and critical infrastructure.
Broader Industry and Regulatory Context
The release of new models earlier this year from Anthropic and OpenAI with powerful cyber capabilities had previously prompted warnings from politicians and financial regulators. Those concerns led the US government to temporarily limit their rollout.
Readers interested in more details regarding the incident can view community discussions or additional coverage by visiting the <a href="https://arstechnica.com/security/2026/10/hackers-got-a-four-day-head-start-on-epic-php2shell-vulnerability/#comments">49 Comments</a> page or checking the <a href="https://arstechnica.com/civis/threads/hackers-got-a-four-day-head-start-on-epic-php2shell-vulnerability.1515356/">Forum view</a>.
As organizations globally race to apply patches and secure infrastructure, cybersecurity experts emphasize that vigilance is required to mitigate ongoing exploitation attempts.
Sources
- Ars TechnicaHackers got a four-day head start on epic PHP2Shell vulnerability
Continue chronologically
Related entity coverage
Related stories
Will AI expose the rickety infrastructure of the internet?
An analysis of recent critical PHP vulnerabilities and how the rise of artificial intelligence may expose foundational weaknesses in web infrastructure.
PHP Critical Bugs Threaten Internet Stability
Critical vulnerabilities in the widely used PHP programming language threaten global web infrastructure as security researchers race to patch systems.
How AI Tools Helped Uncover Years-Old PHP Vulnerabilities
Security researchers used frontier artificial intelligence tools to expose long-standing flaws in the PHP scripting language, triggering rapid attacks.
Websites Move to Block Autonomous AI Agents
Major websites, airlines, and financial institutions are blocking AI agents from OpenAI, Meta, and Google, undermining their utility.
