7 out of 10 websites you visit may be compromised, because nearly 70% of the internet’s websites run on PHP. And two critical vulnerabilities just gave security teams around the world a very unpleasant Wednesday.
What PHP2Shell is
On October 21, researchers from OpenAI, Wiz and other security organizations publicly disclosed two vulnerabilities in PHP, the language powering WordPress, Drupal, Joomla and millions of websites.
Both received a critical severity score of 9.2 out of 10.
They're being called PHP2Shell. An attacker could potentially send specially crafted requests to a vulnerable website, execute malicious code on its server, and access sensitive information including passwords, API keys and authentication tokens.
The flaws existed in PHP itself and even well-written applications are exposed because of the runtime underneath them.
Researchers at Wiz demonstrated remote code execution against WordPress, Drupal and Joomla, alongside techniques for exposing sensitive server memory.
How AI found bugs that were more than a decade old
The underlying bugs had existed for more than a decade.
So how did we suddenly find them?
AI, of course!
Researchers at Calif and Wiz used frontier AI models to uncover and validate vulnerabilities that had survived years of security research.
The vulnerabilities were reported to PHP's security team in August 2026. The researchers coordinated with maintainers to develop patches before publicly disclosing the flaws.
Exploited before it was disclosed
But on October 20, technical details and CVE identifiers leaked online, forcing an accelerated disclosure.
And it gets worse.
Amazon Threat Intelligence has now confirmed detecting an exploitation attempt on October 17, FOUR DAYS before public disclosure.
Someone was already attempting to exploit PHP2Shell while the vulnerability was still under embargo. Amazon couldn't confirm whether the attempt would have succeeded against a real system.
By October 21, additional exploitation attempts were appearing, and PHP released official patches that same day.
Cloudflare also deployed protective rules ahead of the public disclosure.
For decades, discovering and weaponizing certain vulnerabilities required extraordinary expertise, patience and resources. Script kiddies with tokens are now doing it in hours.
Also, if you’re like 13 and don’t know what to do with this information: patch your damn websites!
Questions for CTOs, CISOs and engineering leaders
For CTOs, CISOs and engineering leaders, this incident raises some uncomfortable questions.
How quickly can your organization identify every application running a vulnerable dependency? How long does an emergency patch take to reach production? And how confident are you that your security team can respond when exploitation may begin before a vulnerability is even publicly disclosed?
We've spent ages discussing how AI will make software engineers more productive. All I’ve seen is people lose either their job or in this case, their sleep.
Want us to run your search for you?
Book a free market audit call. We’ll review your positioning, assess your market and show you what it takes to land interviews.
Book a Free Market Audit →