The smoke alarm has stopped beeping. The PHP vulnerability is now a live attack. Hackers are going after two critical flaws in the software that helps run as much as 70 percent of the world’s websites, and governments from Washington to Tokyo are telling everyone to patch right now.
Wiz Research, which used OpenAI technology to find the flaws, disclosed them Wednesday, Oct. 21. NPR reports that the PHP Foundation shipped two patches. Attackers moved in almost immediately anyway. For the technical details on both bugs, see our breakdown of the two PHP flaws that let hackers run code without a login.
How bad are the PHP2Shell attacks?
Bad enough that Cloudflare CEO Matthew Prince said the company saw “millions” of exploit attempts in the hours after the announcement, as PBS NewsHour reported. That count comes from Cloudflare itself, though, and we have not seen an independent tally.
Here is the part that should make you sit up. Prince also said Cloudflare saw thousands of attempts in the 10 hours before the public announcement.
Somebody knew first.
Amazon Threat Intelligence backs that up. It says it caught an exploit attempt against a decoy system on Oct. 17, four days before disclosure. Amazon also adds that proof-of-concept exploits showed up within hours of the patch, and that PHP2Shell is now “broadly exploited in the wild,” according to ABC News. The methods vary, which points to multiple attackers. How anyone learned of the flaws early is still unclear.
Who got knocked offline by the PHP flaw
The damage is already real. Dozens of British and Finnish government services went offline this week, and many French local government sites were briefly down, according to NPR. The Port of Rotterdam is among the operators that pulled sites down on purpose, per The Conversation.
That is the smart move, by the way. The FBI’s cyber division warned that the flaws could allow remote code execution, so it recommended taking a site offline if it can’t be updated right away. A dark site beats a hijacked one.
The warnings came from everywhere:
- The NSA told PHP users to “maintain heightened awareness” in the coming weeks.
- The UK’s NCSC urged “immediate action.”
- The EU’s cybersecurity agency, ENISA, said the same.
- Japan’s Prime Minister Sanae Takaichi issued “an urgent request for everyone to take action.”
When a prime minister personally asks the whole country to update its software, this is not routine maintenance.
What this PHP vulnerability means for you
PHP is old, and it is everywhere. Wiz calls it “the backbone of the web.” It sits under WordPress and Drupal, and Wiz found ways into systems running both.
Here’s the thing: if you run a website, a store or a blog on one of those platforms, this PHP vulnerability is your problem. Not your hosting company’s problem. Yours.
The researchers say the flaws can be chained, so a crafted request could let an attacker take over a PHP-powered system. Cloudflare warns of remote code execution, service disruption and customer data exposure. Wiz put it bluntly: these findings “rank among the most severe vulnerabilities discovered in PHP, and arguably in software history.”
The PHP team says updating the code is the only complete fix. No setting, no plugin, no workaround.
The AI twist behind this PHP bug
Here is the irony. AI found these holes, and AI may help attackers exploit them faster. Gang Wang of the University of Illinois told CNN that not every organization will patch at once. As a result, attackers get a window they can now work faster with AI tools.
OpenAI itself called the discovery “one of the most impactful vulnerabilities in recent memory.” Accounts differ on exactly when the work began, so the timeline is still being sorted out against the PHP Foundation’s own statement. This is not the only time a leak has come from a tech giant’s own tools, either; just look at how Meta’s Muse AI chats were searchable by anyone.
The 70 percent figure is also an estimate. Some outlets say “as much as,” and others say “more than two-thirds.” Either way, that is most of the internet.
What happens next
Many government sites looked fine by Thursday, though some still had outages or limited service. The NSA says to stay alert for weeks, not days.
The race now is simple: every unpatched server is a target, and the attackers are not waiting.
If you manage a site, update PHP today. If you hire someone to do it, ask them whether they have. And if the answer is “we’ll get to it,” remember that the attackers got to it first.
