AI Found a Fatal PHP Flaw — Now the World Is Racing to Patch It

AI found the internet’s weakest link. Can humans patch it fast enough?

A critical flaw in PHP — the programming language behind 70 percent of the world’s websites — has been uncovered not by a team of security researchers sifting through code, but by AI tools. The vulnerability, dubbed php2shell, allows an unauthenticated attacker to remotely execute code on any server running affected versions of the language.

Within 10 hours of the flaw’s public disclosure, Cloudflare reported thousands of exploitation attempts across its network. In the 45 minutes that followed, that number jumped to tens of thousands. Two hours in: hundreds of thousands. By Thursday afternoon, Matt Hull at NCC Group was describing the pace as unprecedented.

“A few years ago, attackers might have taken weeks to exploit a vulnerability,” Hull said. “Now, it can be days or hours.”

The php2shell incident is more than another CVE to track. It is a structural signal: AI is now finding critical vulnerabilities faster than the human patch-and-defend cycle can respond. The consequences are already rippling through governments, businesses, and individual service providers.

Who is most exposed?

PHP has been the backbone of dynamic web content since the early 1990s. WordPress, Wikipedia, Drupal, Laravel, Symfony — these and countless smaller platforms run on it. Wiz, the cybersecurity firm that helped reveal the php2shell flaw alongside researchers at California, estimates it powers 70 percent of websites globally.

That reach makes targeted defense nearly impossible. A small auto repair garage in Chepstow, South Wales, told the BBC its MOT certification system had been offline since Wednesday morning. The owner could still perform vehicle inspections, but could not print certificates or process paperwork, forcing a return to paper records and customer delays. For a business operating on thin margins, every hour of downtime translates directly into lost revenue and eroded customer trust.

At the other end of the scale, Amazon confirmed hackers attempted to exploit the flaw, though its websites continued operating normally. The UK government took a different route: it proactively shut down 32 government services and left four partially available as a precaution. Baroness Lloyd of Effra confirmed the status in the House of Lords, stressing that the outages were protective measures, not evidence of compromise.

“This does not mean they were hacked,” a government spokesperson said. “Work continues to resolve any issues.”

The decision to take services offline rather than attempt rapid patching reveals a fundamental asymmetry in how AI and human defenders operate. AI can generate proof-of-concept exploits in minutes; human teams must coordinate change management, testing, rollback plans, and stakeholder communication — processes that cannot be rushed without introducing new risks.

The speed problem no one can solve yet

The real urgency here is temporal. OpenAI — whose tools helped researchers at Wiz uncover php2shell — is now also being consulted by the UK government on the response. The same AI that accelerated discovery is being asked to accelerate mitigation. But patch deployment is a fundamentally different kind of work than vulnerability discovery.

Discovery scales. Patching requires coordination across countless independent system administrators, each working against their own internal timelines, legacy dependencies, and budget constraints. A municipal council running a decade-old Drupal installation may not have the expertise to apply a security patch without breaking upstream functionality. A freelance developer managing a portfolio of client sites lacks the resources to test updates across dozens of heterogeneous environments.

NCC Group’s Hull warned that security professionals may already be facing significant burnout days into the incident. “Resilience depends on people as much as technology,” he said, urging teams to share the workload and rest.

The php2shell flaw was theorized by the PHP Foundation as early as 2024. Theoretical vulnerabilities and exploitable ones are not the same thing. AI appears to have closed that gap far more quickly than the human ecosystem behind PHP could close it.

This creates what experts are calling a “detection-to-exploitation compression” — a phenomenon where the time between public knowledge of a flaw and widespread weaponization shrinks to near zero. In prior decades, that window allowed security teams to develop signatures, deploy patches, and harden systems before attackers could mass-produce usable exploits. That luxury no longer exists.

Second-order effects: who pays the price

The php2shell incident is already generating cascading consequences beyond the initial vulnerability. Insurance providers are reassessing cyber liability policies, with some brokers reporting inquiries from small businesses worried about whether they can meet new security baseline requirements. Cloud hosting providers are bundling automatic PHP update notifications into their dashboards, anticipating demand from clients who lack in-house technical staff.

Supply chain effects are emerging as well. Companies that build CMS platforms, e-commerce frameworks, or SaaS products on top of PHP are fielding urgent requests from enterprise customers demanding confirmation that their software is patched. Some vendors have responded by issuing hotfixes ahead of their normal release cadences, risking the introduction of regressions in the name of speed.

Perhaps most quietly, the incident is shifting procurement standards. Government tenders in multiple jurisdictions are beginning to require demonstrable patch management capabilities as a precondition for contract awards — a change that will disproportionately affect smaller contractors who lack dedicated security operations teams.

What happens next

The UK’s National Cyber Security Centre called the event “unprecedented” and expected it to be “universally felt.” So far, there are no confirmed successful breaches. But experts warn that the full impact may take months to materialize — attackers who observed the disclosure without immediately exploiting it may still strike later, once defenses have settled into a new normal.

The php2shell incident also raises a deeper question about the future of cybersecurity research. When AI tools can surface critical flaws at scale, the bottleneck shifts from discovery to response. That shift will favor well-resourced organizations and penalize everyone else — small businesses, individual developers, and underfunded government departments that lack the infrastructure to patch rapidly.

We are entering an era where the most valuable security asset is not the ability to find vulnerabilities but the ability to act on them before attackers do. For organizations with mature patch management pipelines, automated testing, and dedicated incident response teams, the php2shell incident will be a stressful but manageable event. For everyone else, it may prove existential.

The race to secure the internet’s oldest and most widespread language is now a race against an AI-accelerated threat landscape. Whether human defenders can close that gap remains the question php2shell has made impossible to ignore — and the answer will define cybersecurity for years to come.