PHP's creators disclose a critical memory-management vulnerability, dubbed "PHP2Shell", that affects up to 70% of websites, discovered via GPT-5.6 Sol in August

If you manage a website built on PHP, you must manually update your server's PHP version now to prevent compromise.

PHP, a programming language used for websites and web applications, has released security patches to address two critical vulnerabilities, rated 9.2 out of 10 in severity. These vulnerabilities, described as Remote Code Execution exploits, affect all PHP versions from 5 onward. They could allow attackers to execute their own code on servers, leading to website alteration, data theft, and other malicious activities. Cybersecurity firms estimate that over 1.3 million internet-connected hosts may be impacted. Given that WordPress powers over 40% of the internet and relies on PHP, a significant number of WordPress sites are vulnerable. The patches require manual installation, as they are not available through automatic updates. Cybersecurity agencies have advised users unable to patch immediately to take systems offline or isolate them from public networks. Early attacks are already being observed, with mass exploitation anticipated shortly after the patch release.

The rapid discovery and disclosure of critical PHP vulnerabilities via advanced AI tools like GPT-5.6 Sol highlight a new era in cybersecurity. This incident suggests that AI is becoming an indispensable tool for both finding and potentially exploiting complex software flaws at an unprecedented scale and speed. The widespread impact, affecting up to 70% of websites, underscores the interconnectedness of the web and the systemic risk posed by core infrastructure components. This event also validates the concerns about AI's dual-use capabilities, where the same technology used for defense can be leveraged for offense.

The urgency of the advisory, with recommendations to take systems offline, points to the severity of the exploits and the immediate threat to sensitive data and system integrity. The requirement for manual patching, rather than automatic updates, creates a significant window of vulnerability for site owners, potentially leading to widespread breaches if not addressed promptly. This situation will likely spur greater investment in AI-powered security solutions for proactive threat detection and faster patching mechanisms across the web development ecosystem.