Cybersecurity experts are warning that recently disclosed vulnerabilities could spark chaos across the internet.
The team behind PHP, a programming language used by popular website platforms including WordPress, released emergency security patches Wednesday to address two vulnerabilities that could allow hackers to take control of vulnerable web servers.
The PHP development team first warned of the vulnerabilities on Tuesday, rating both 9.2 out of 10 on the Common Vulnerability Scoring System.
“We are urging every organization and individual running PHP to prepare now so they can apply the update as soon as it is available,” the PHP Foundation said in a press release.
In a security advisory accompanying Wednesday’s patches, PHP developers confirmed that the vulnerabilities could allow hackers to remotely execute code on vulnerable servers without authorization.
The first flaw involves how PHP handles running out of memory, which can cause it to mistakenly process incomplete or corrupted information. The second flaw involves PHP mistakenly using outdated information from an earlier website request after the memory storing it has been released, potentially opening the door to malicious code execution. Together, the security flaws are being called “PHP2Shell.”
Security experts were sounding the alarm even before the patches were released. Security researcher Silas Cutler estimated that roughly 1.3 million internet hosts could be affected by the vulnerabilities.
“We expect mass attacks to start within 15 minutes of the release,” cybersecurity firm Sansec warned in a blog post, referring to the release of the emergency patches. The concern is that hackers could quickly analyze the updates to figure out how to exploit the vulnerabilities and launch automated attacks against websites that haven’t installed the fixes.
Cloudflare reported Wednesday that the company was already seeing early attacks targeting the vulnerabilities and was updating its security protections as attackers developed new methods to bypass them.
It turns out PHP’s developers had known about an underlying problem behind one of the vulnerabilities for nearly two years.
In a Wednesday blog post, the PHP Foundation disclosed that its developers first identified signs of the problem in 2024. However, they struggled to agree on how to fix it without creating new issues, delaying a solution for months. The foundation called the delay a “structural failure” caused by “the security team’s decision process and its lack of resources.”
The Wall Street Journal reported on Wednesday that Ryan Austin, a researcher at cybersecurity firm Calif, discovered the vulnerabilities while auditing PHP’s source code with the help of OpenAI’s GPT-5.6 Sol model. Calif and OpenAI reported the findings to PHP’s developers in August.
This incident underscores growing concerns about the ability of increasingly powerful AI models to identify and potentially exploit cybersecurity vulnerabilities. While these tools can help researchers uncover security flaws, they could also give hackers new ways to find weaknesses.
“We are now prioritizing measures to make sure vulnerabilities that need similarly complex fixes get resolved faster when they are reported in the future. The PHP Foundation and the PHP security team learned a lot in the last weeks and will work to turn their experiences into lasting repeatable processes,” the foundation said.
Meanwhile, a separate security scare is raising concerns about another critical part of the internet’s infrastructure.
At the center of that incident is eMudhra, an Indian company that issues digital certificates used to verify websites. Eight of its certificates were found to have weak security keys that allowed attackers to potentially use them to impersonate legitimate websites and trick vulnerable browsers into trusting them. Major browsers, including Google Chrome and Mozilla Firefox, have already blocked the affected certificates.
