Quietly beneath the everyday machinery of the internet sits PHP, a language born as a personal home page tool and now carrying roughly seventy percent of the world's websites, from government portals to the largest social platforms. This week its stewards, the PHP Foundation, released fixes for two security flaws, now collectively called PHP2Shell, which had lingered unnoticed for at least a decade. The bug surfaced when researchers used an artificial intelligence model to probe code that people had long sensed was wrong but no one had managed to weaponize. The lesson being drawn is less about
PHP2Shell Bug Puts Up to 70% of Websites at Risk; Patches Now Available
The gap between patch and exploit "is the whole game"
Mark
Seventy percent of websites sounds enormous. Why does one language matter so much?
Mimi
PHP runs government sites, Facebook, Wikipedia. When two flaws sit in the language itself, every site using it unpatched is potentially exposed.
Luke
Careful with the number, though. The reporting says "up to 70%." That's a ceiling for PHP's reach, not a count of vulnerable sites.
Mark
Fair. So what can attackers actually do?
Mimi
Researchers say they could seize control of unprotected servers, install malware, steal customer data, or take a site down.
Mark
And for someone with an online shop account?
Mimi
Mediatech's Voldemaras Kadys says visiting a site won't necessarily compromise your device. The risk is the data the site holds: email, address, name, date of birth.
Luke
And nobody has said any of that has been stolen. Kadys himself says we don't know what was taken or from where. Vulnerable isn't breached.
Mark
What's striking is that an AI model found it.
Mimi
Yes, per the Wall Street Journal's Robert McMillan, and the bug had existed at least ten years. People sensed something strange but couldn't build an exploit.
Luke
Worth noting that's one reporter's account of how it was found, and the piece doesn't say how the model was used. Guerrero-Saade's point about AI helping attackers is his assessment, not a documented attack.
Mimi
The practical takeaway is simple: patches are out, and the FBI's cyber division suggests taking sites offline if they can't be patched right away.
Le Pouls
- A flaw hidden for at least ten years in the language behind most of the web has just been named PHP2Shell and laid bare.
- Researchers found it using an OpenAI model, and the discovery itself is alarming because it shows how fast hidden weaknesses can now surface.
- Attackers could seize servers, install malware, or quietly drain customer names, addresses, and birth dates from unpatched sites.
- The PHP Foundation has published fixes and urged every operator to update immediately, while the FBI advises taking unpatchable sites offline for now.
- The race is on: fixes exist, but every day an unpatched site stays online is a day AI-accelerated attackers may exploit it.
Quietly beneath the everyday machinery of the internet sits PHP, a language born as a personal home page tool and now carrying roughly seventy percent of the world's websites, from government portals to the largest social platforms. This week its stewards, the PHP Foundation, released fixes for two security flaws, now collectively called PHP2Shell, which had lingered unnoticed for at least a decade. The bug surfaced when researchers used an artificial intelligence model to probe code that people had long sensed was wrong but no one had managed to weaponize. The lesson being drawn is less about one language than about a changing tempo: the interval between a repair and an attack is shrinking, and the responsibility now rests with each site operator to close the gap before it is used.
On Wednesday, the PHP Foundation, the volunteer group that maintains the PHP programming language, published fixes for two security flaws and asked everyone running the language to update without delay. PHP, whose name began as shorthand for "Personal Home Page," now underpins as much as 70 percent of the world's websites, including government services, major social networks, and Wikipedia. Researchers have named the vulnerability chain PHP2Shell.
The flaws were brought to light when security researchers used an OpenAI artificial intelligence model to find them. According to Wall Street Journal reporter Robert McMillan, the bug had likely existed for at least a decade, and people had sensed something was off, yet no one had built a working exploit. Many sites, he warned, may not realize they are exposed until something goes wrong.
Voldemaras Kadys of Mediatech explained what is at stake. Simply visiting a PHP website does not usually compromise a device. The real danger is an attacker breaking into a site that stores personal information, such as the names, addresses, email addresses, and birth dates of online shoppers. A vulnerable site is not automatically a breached one, Kadys said, and people need not stop browsing or shopping, but they should be wary of suspicious messages, since no one yet knows which sites may have lost data.
Andrés Guerrero-Saade of SentinelOne said the episode shows AI helping defenders and attackers alike. The window between discovery and fix, and between fix and exploitation, has narrowed, and in his view that gap is now the central contest. The FBI's cyber division added its own advice on X: organizations that cannot patch right away should take their sites offline temporarily.
The fixes are out. What happens next depends on how quickly site operators apply them, because the time between a patch and an attack is getting shorter.
On Wednesday, the PHP Foundation, the group of developers who work on securing the PHP programming language, published fixes for two security flaws and told anyone running PHP to update immediately. Its announcement on php.net carries the technical details, the attack vectors and instructions for updating on each type of system. The urgency comes from how widely the language is used.
PHP, short for "Personal Home Page," powers up to 70% of the world's websites and web applications. That includes sites run by government agencies, social media platforms such as Facebook, and Wikipedia. Researchers have given the bug that can target the two flaws a name: PHP2Shell.
Voldemaras Kadys, head of security at Mediatech, says the weaknesses could let cybercriminals take control of unprotected website servers, install malware, steal customer data and even take sites down completely. In an email, he said the potential impact may be huge because most websites run on PHP.
The flaws came to light when security researchers used an OpenAI artificial intelligence model to identify the problem. That is according to Wall Street Journal reporter Robert McMillan, who first reported on the issue and described it to CBS News. McMillan noted that the bug had existed for at least a decade. People had sensed something odd was going on, he said, but no one had managed to write an exploit, meaning a way to turn a bug that might crash a computer into something that lets a stranger run software they were never supposed to be able to run. He also warned that many sites may not know they have a problem and could find out the hard way.
For ordinary users, Kadys said, simply visiting a PHP website does not necessarily compromise a device. The danger lies in attackers breaking into a site that holds personal information. If you have an account with an online shop, for example, a hacker who exploits the flaw could extract the email address, physical address, name and date of birth stored there. A vulnerable site is not necessarily a breached one, and a breach is not guaranteed to happen. Kadys said there is no reason to stop browsing or shopping online, but people should be extra cautious about suspicious messages, because nobody knows what data may have been taken or from which sites.
Andrés Guerrero-Saade, vice president of intelligence and security research at SentinelOne, told CBS News the episode shows how AI is accelerating vulnerability researchers' work while also strengthening bad actors' ability to exploit flaws. The time between discovering a vulnerability and releasing a fix matters enormously to security experts, he said, and AI has compressed that window, letting criminals move faster than before. In his words, the gap between a patch becoming available and attackers exploiting the hole before anyone applies it is essentially the whole game.
The FBI's cyber threat division weighed in with a post on X. It encouraged any organization unable to patch its sites right away to take them offline temporarily.
The fixes now exist, so what matters next is how quickly site operators apply them. Because AI is shortening the time between a patch and an attack, the window for sites that have not updated is the thing to watch.
Citations marquantes
If you run PHP, it is imperative that you update now.— PHP Foundation
That whole gap between the patch being available and attackers getting to exploit that before anybody patches, that's the whole game essentially.— Andrés Guerrero-Saade, SentinelOne
Envie de l'histoire complète ?
Lire l'original sur CBS News ↗
Politics & Governance