PHP rarely makes headlines, yet the programming language has been a foundation of the web for more than three decades. It is estimated to run nearly 70% of websites and online applications, including WordPress, the platform behind more than 40% of all websites.
That widespread use is now driving an urgent security warning. PHP’s development team has issued updates for two critical flaws, each carrying a danger rating of 9.2 out of 10. If exploited, the vulnerabilities could enable attackers to seize control of internet-connected servers.
On Wednesday, the PHP team released patches for what it described as “two critical vulnerabilities that can allow unauthenticated remote code execution.” The official PHP website advised every user to install the updates immediately.
The U.S. Cybersecurity and Infrastructure Security Agency, or CISA, echoed that warning, urging organizations to “immediately patch the recently disclosed critical vulnerabilities in PHP.” Although the agency said it had not seen evidence of exploitation when its notice was published, it warned that unpatched systems could put organizations at risk.
The FBI’s Cyber Division issued a similar recommendation, telling all potentially affected organizations to update their PHP installations without delay.
If an immediate patch is not possible, the FBI advised taking the affected system offline until the vulnerability can be fully addressed.
Britain’s National Cyber Security Centre delivered the same message, encouraging organizations to prepare for immediate updates to PHP-based systems. Where remediation cannot happen at once, it said organizations should consider disconnecting the systems until they are fully protected.
OpenAI said Wednesday morning that its artificial intelligence models helped security researchers uncover the PHP vulnerabilities.
“Over the past two months, we led a coalition of maintainers, researchers, and security providers to prepare fixes and protections ahead of disclosure,” OpenAI said in a statement. Given PHP’s enormous reach and the seriousness of the flaws, the company called the discovery one of the most consequential vulnerabilities in recent memory. It described the episode as evidence of a new era in which AI can identify security weaknesses with internet-scale consequences.
OpenAI also said it believes its model found the vulnerabilities before criminals had an opportunity to exploit them.
In a post published later Wednesday, the PHP Foundation said researchers had theorized about a potential exploit as early as 2024. However, no specific attack path had been identified, while other issues with more obvious consequences took priority. Progress on a fix then repeatedly stalled and resumed as the relevant experts balanced the work against other responsibilities.
According to the foundation, the PHP project was submitted to OpenAI’s Patch the Planet program, and a security audit began in July. OpenAI identified possible exploitation methods in September. Reports from the AI company, an independent security researcher and website security provider Wiz persuaded the PHP team that the matter had to become a “top priority,” prompting work that began on August 11, the foundation said.
As details of the vulnerabilities began appearing on online forums and social media in recent days, the PHP team chose to move up its planned disclosure and patch release, the foundation said.
“We won’t pretend otherwise: the delay was a structural failure,” the foundation acknowledged.
Amazon Threat Intelligence said in a blog post Wednesday evening that it detected an intrusion attempt on Oct. 17. The activity suggests a threat actor may have known about the PHP flaws four days before the developers publicly announced them and released the fixes. The attack targeted one of Amazon’s decoy systems, which are designed to attract and monitor hackers, though Amazon said it could not determine how the actor learned about the vulnerabilities in advance.
After the disclosure embargo ended and the patch became available, more proof-of-concept exploits surfaced within hours. Amazon said those exploits were almost immediately used against its sensors and warned that “PHP2Shell is now being broadly exploited in the wild.”
Amazon urged organizations to rethink their response times, saying critical patches for internet-facing systems should be installed within hours rather than days or weeks. It also recommended searching for evidence of compromise dating back to Oct. 17.
Before the official patch was released, cybersecurity company watchTowr warned that the flaws could allow attackers to execute their own code on vulnerable servers. It advised organizations operating PHP in production to be ready to update quickly as soon as the fix became available.
The PHP team says installing the update is the only complete solution. It has outlined temporary steps, including changes to memory and file-upload settings, but cautioned that these measures merely limit exposure. They do not eliminate the possibility of exploitation or make an affected server fully safe.