AI Found a Decade-Old PHP Flaw. Now Government Sites Are Shutting Down

The Paradox of Instant Discovery

An AI tool found a flaw in PHP that sat undetected for more than a decade. Then it also made it trivially easier for anyone who wanted to weaponize that flaw.

That is the central tension of what happened this week. On August 21, PHP developers released emergency patches for two critical vulnerabilities—dubbed PHP2Shell—rated 9.2 out of 10 on the CVSS scale. Within hours, government portals in the Netherlands went dark. Hospitals, schools, and port authorities in Denmark, Finland, Germany, and Austria followed. The U.S. government mobilized federal agencies and critical infrastructure protection teams to push patches.

No one had been hacked yet—at least no one admitted it. But the threat landscape shifted in a single day.

Who Actually Runs the Web

Here is what most English-language coverage glosses over: PHP powers roughly 70% of all websites. WordPress, which runs about 40% of the internet, depends entirely on it. Drupal, Joomla—all PHP. This is not a niche language used by hobbyists. It is the operating system of the public web, and it is ancient.

The two PHP2Shell vulnerabilities allow unauthenticated command execution on servers. An attacker needs no account, no password, no special access. They send a carefully constructed request and suddenly they own the machine. Data exfiltration, site defacement, full system takeover—all available to whoever can craft the exploit first.

The bug has been in PHP code for over ten years. Finding it required not just reading that code, but understanding an exceptionally complex chain of conditions that link a server-side flaw to actual remote code execution. That chain is what kept attackers away from it for a decade.

The AI Short-Circuit

This is where the story gets new.

A security company called Calif used OpenAI’s GPT-5.6 Sol to identify the vulnerability and reported it in August. Wiz, Alphabet’s security subsidiary, independently confirmed the same issue using its own AI tools alongside both Gemini 4 Argon and GPT-5.6 Sol.

Wiz put it bluntly: a global research team that would have taken months to solve this problem was bypassed by a single researcher working for about a week. The AI did not replace human expertise. It removed the friction that separated curiosity from capability.

That matters because the same models are available to everyone. Attackers do not need PhD-level reverse engineering skills anymore. They need prompts.

The Structural Failure

The PHP Foundation acknowledged something uncomfortable. In 2024, developers spotted signs of a vulnerability in PHP code. They could not trace the specific attack path. They could not agree on a fix. The foundation called it a “structural failure”—insufficient resources, unclear decision-making processes, and a maintainership pipeline that was already strained.

This is not a story about one lazy developer skipping a line of code. It is a story about an entire ecosystem that has not kept pace with its own scale. PHP is open source and free, but free infrastructure requires funded maintenance. That funding has been inconsistent at best.

When the PHP2Shell details and proof-of-concept videos leaked before the scheduled disclosure date, developers moved the patch release forward by a day—to August 21. They tried to stay ahead. But in doing so, they also gave attackers early intelligence about exactly what they were fixing and how.

The Race That Follows

Cloudflare reported observing initial attack attempts immediately after the patch drop. CISA stated it had not yet confirmed any successful intrusions. That gap between observation and confirmation is where the next weeks will play out. Every server running an unpatched version of PHP is a door left unlocked in a building everyone now knows how to pick.

Sensis, a web infrastructure analytics firm, found that out of roughly 2.6 million hosts it observed, about 1.5 million were running PHP versions that cannot receive the fix at all. These are servers on discontinued releases with no upgrade path, often running on outdated operating systems, managed by organizations that lack the staffing or expertise to migrate.

That 1.5 million figure is the real story. The government sites that went dark in Europe are the visible symptoms. The 1.5 million unreachable hosts are the disease.

Who Wins. Who Loses.

Winners in this scenario are the AI security vendors—Calif, Wiz, and the companies building similar tools—who get to demonstrate that their approach works at scale. Their customers get stronger defenses. The market for AI-assisted vulnerability discovery just expanded overnight.

Losers are the thousands of organizations running legacy PHP on end-of-life servers, many of them in the public sector, healthcare, and education. These are the institutions that cannot simply spin up a new stack. They have data migrations, compliance requirements, and budgets that were never designed for infrastructure this deep.

Governments are caught in the middle. The Dutch, German, Finnish, and Danish responses—taking sites offline proactively—were the right call. But taking a website down is not the same as securing it. A government portal that does not exist cannot be hacked, but it also cannot serve citizens.

What Happens Next

The immediate pressure is clear: check whether your PHP is current, apply the patch, and verify the installation. Automated WordPress updates do not cover this. The server-level PHP runtime itself must be updated. For the 1.5 million hosts on unsupported versions, there is no patch. The only option is migration—moving to a supported PHP release, which often requires application-level code changes that small organizations simply cannot absorb on short notice.

The NSA and European security agencies are recommending that organizations unable to patch quickly should block external access to affected systems until they can verify the fix. The UK’s NCSC is advising agencies to check for signs of prior intrusion. Both are reactions to a threat that exists only because discovery outpaced defense.

This pattern will repeat. AI tools are now finding decade-old vulnerabilities in widely deployed code faster than any human research team could. Vendors cannot patch fast enough to stay ahead of the discovery curve. Attackers who reach a vulnerability first gain a window that is measured in hours, not months.

The PHP2Shell episode is not an anomaly. It is a preview.