A major cybersecurity discovery is raising urgent questions about the growing role of artificial intelligence in protecting—and potentially threatening—the internet. Researchers using advanced AI models uncovered a collection of software vulnerabilities that could expose sensitive data, disrupt online services and allow attackers to take control of vulnerable systems.
The flaws, collectively dubbed PHP2Shell, were identified by researchers working with OpenAI, Google-owned cybersecurity company Wiz and another cybersecurity firm identified as Calif. The vulnerabilities were reportedly significant enough to prompt security updates and temporary disruptions affecting several government and corporate websites around the world.
The discovery also highlighted a troubling reality for cybersecurity experts: weaknesses that have existed in widely used software for years may become much easier to exploit as AI tools improve.
According to researchers at Wiz, artificial intelligence dramatically accelerated the investigation, allowing a single researcher to complete work that might previously have required a highly specialized team working for months.
Although the vulnerabilities were discovered in late August and publicly disclosed only after a fix became available, their implications extend far beyond one programming language. The incident illustrates how AI is changing the balance between cybersecurity defenders and potential attackers.
What Is PHP2Shell, and Why Is It Dangerous?
PHP2Shell refers to a collection of vulnerabilities affecting PHP, a widely used programming language that powers websites and web applications.
The flaws could allow attackers to execute code remotely on vulnerable systems, potentially giving them the ability to interfere with services, access sensitive information or compromise affected applications.
Depending on the system and the protections in place, successful exploitation could expose information stored in memory, including credentials and other confidential data.
The vulnerabilities are particularly concerning because PHP remains an important part of the internet’s underlying infrastructure. A security weakness in software used across numerous websites can create risks well beyond a single organization.
Reports surrounding the discovery suggested that the issue could affect a substantial portion of the web, with estimates reaching as high as 70%. However, that figure should not be interpreted as confirmation that 70% of websites were vulnerable or successfully compromised.
The actual exposure depends on which software versions and configurations are in use, as well as whether systems have received the necessary security updates.
For organizations operating public-facing websites, the immediate priority is to determine whether their systems are affected and apply the appropriate patches.
How Artificial Intelligence Helped Researchers Find the Flaws
One of the most striking aspects of the PHP2Shell discovery was the speed at which researchers were able to investigate the vulnerabilities.
According to Wiz, advanced AI models helped researchers work through a complicated series of technical steps that would traditionally demand considerable time and specialist expertise.
The research involved Google’s Gemini 4 Argon, Wiz Atlas and OpenAI’s GPT-5.6 Sol, according to the reported disclosures.
These tools helped researchers investigate software behavior, analyze potential weaknesses and establish how the underlying flaws could be exploited.
In a blog post published on Wednesday, Wiz researchers described the scale of the acceleration, saying that a single researcher had accomplished in a week what previously might have taken a world-class team months.
The significance lies not simply in AI’s ability to identify suspicious code. Finding a potential vulnerability is only one stage of a cybersecurity investigation. Researchers must also understand the conditions under which the flaw can be triggered and determine whether it creates a practical security risk.
That process can involve connecting multiple technical steps, examining how software handles unexpected inputs and testing whether a theoretical weakness can be turned into a working exploit.
AI appears to have substantially reduced the effort required to navigate that process in this case.
For security teams, that creates an opportunity to discover and fix dangerous weaknesses sooner. But it also raises concerns that attackers could use similar capabilities to identify exploitable flaws at a much greater scale.
A Longstanding Software Weakness Becomes a Practical Threat
According to Wiz researchers, the underlying vulnerabilities had existed for years, yet demonstrating their exploitability required an exceptionally complicated sequence of steps.
In their assessment, the technical difficulty had previously placed successful exploitation near the limits of what human researchers could practically accomplish.
Advanced AI models lowered that barrier, making it easier to turn a longstanding software weakness into a workable exploit.
This distinction is crucial.
A vulnerability can exist in a system for years without becoming a widely exploited threat. Attackers may lack the necessary expertise, time or resources to develop a reliable method of taking advantage of it.
AI can change that equation by helping researchers and attackers automate portions of complex technical investigations.
As a result, weaknesses once considered difficult to exploit may demand more urgent attention from security teams.
The PHP2Shell discovery therefore demonstrates why organizations cannot assume that a vulnerability is relatively harmless simply because it has remained undetected or difficult to exploit for a long time.
As AI capabilities advance, the practical risk associated with older software flaws may change significantly.
Why Some Government Websites Temporarily Went Offline
The public disclosure of PHP2Shell prompted organizations to review their systems and implement security measures.
According to Reuters, some government websites in Europe temporarily went offline as organizations updated their infrastructure.
Such disruptions can occur when administrators take vulnerable systems out of service while applying patches, testing changes or confirming that their software is secure.
Although temporary downtime can inconvenience users, it may be preferable to leaving a potentially exposed system accessible to attackers.
The response also demonstrated the coordination required when a vulnerability affects widely deployed technology. Software maintainers, cybersecurity companies, infrastructure providers and government agencies may all need to work together to reduce the risk.
Cloudflare, a major web infrastructure provider, worked with the PHP Foundation, Calif, OpenAI and Wiz to address the issue, according to the reported disclosures.
Their collaboration helped support the process of identifying the vulnerabilities, preparing a remedy and communicating the risks to organizations that could be affected.
The episode serves as a reminder that cybersecurity incidents involving widely used software can have consequences across multiple countries and industries, even when there is no confirmation of widespread exploitation.
Security Agencies Urge Organizations to Update PHP
The PHP Foundation, which supports the programming language at the center of the issue, released a patch to address the vulnerabilities.
Website operators were urged to update their systems promptly to reduce the risk of exploitation.
The National Security Agency also issued a warning through social media, urging organizations using PHP to install the available updates. Organizations unable to patch their systems were advised to take them offline.
That recommendation underscores the seriousness of remote code execution vulnerabilities. If attackers can execute unauthorized commands on a vulnerable server, they may be able to compromise applications, disrupt operations or gain access to information that should remain protected.
Organizations should therefore identify systems running affected software, determine whether their versions are vulnerable and prioritize remediation.
Applying a patch is an essential first step, although organizations may also need to investigate suspicious activity and review their security controls, depending on their exposure.
For businesses that rely on PHP-powered websites, delaying updates can leave an avoidable security gap.
Why Researchers Are Comparing PHP2Shell to Heartbleed
Wiz researchers have compared the potential significance of PHP2Shell with Heartbleed, a major security vulnerability disclosed in 2014.
Heartbleed affected OpenSSL, a widely used software library that helps secure communications over the internet. The flaw allowed attackers to obtain information from server memory that should have remained protected.
Its impact was substantial because OpenSSL was embedded in many internet services and security systems.
The comparison with PHP2Shell reflects concerns about both the reach of widely used software and the possibility that AI could make complex vulnerabilities easier to exploit.
However, the two incidents involve different technologies and should not be treated as identical threats.
The broader parallel is that a weakness in foundational software can have far-reaching consequences when that software is used across a large part of the internet.
Wiz researchers suggested that PHP2Shell could represent a turning point in cybersecurity because AI has changed what is practically achievable during vulnerability research.
If advanced models continue to reduce the time and expertise needed to develop exploits, organizations may have less time to respond once vulnerabilities become known.
AI Could Transform the Future of Cybersecurity
The PHP2Shell discovery highlights both the promise and the risks of increasingly capable AI systems.
For defenders, AI can accelerate vulnerability discovery, help security researchers analyze complicated code and reduce the time required to investigate potential threats. These capabilities could improve the speed and effectiveness of defensive security work.
For attackers, the same underlying capabilities could lower technical barriers, enabling more people to investigate software weaknesses and potentially develop exploits.
This creates a difficult challenge for organizations responsible for securing critical infrastructure and online services.
Traditional security strategies remain important, but companies may need to adapt their processes to a world in which vulnerabilities can be identified and weaponized more quickly.
That means maintaining up-to-date software, monitoring systems for suspicious activity, preparing rapid patching procedures and treating newly discovered vulnerabilities with appropriate urgency.
The PHP2Shell incident does not mean that most websites have been compromised. Rather, it demonstrates how quickly the risk associated with an existing weakness can change when new tools make exploitation easier.
The Bottom Line: AI Is Changing the Cybersecurity Race
The PHP2Shell discovery is a warning that the relationship between AI and cybersecurity is evolving rapidly.
Researchers used advanced models to investigate vulnerabilities that had remained difficult to exploit, helping identify a threat that prompted software updates and temporary service disruptions.
The availability of a patch provides a practical way for affected organizations to reduce their exposure. But the larger issue remains: AI is making sophisticated technical work more accessible, potentially accelerating both security research and cyberattacks.
For website operators, the immediate lesson is straightforward: check affected systems, install the necessary updates and avoid assuming that longstanding software weaknesses are no longer dangerous.
For the cybersecurity industry, the implications are broader. As AI tools become more capable, the speed at which organizations can identify, understand and fix vulnerabilities may become just as important as their ability to prevent attacks in the first place.
Source: CNN
