Authorities take government websites offline over PHP flaw

Authorities shut down government websites across Europe on Wednesday over serious PHP security flaws, Hindustan Times reported. The PHP Foundation released security updates at 10 a.m. Eastern that day, earlier than planned, after originally scheduling them for Thursday.

The US National Security Agency told organizations to apply the updates right away or disconnect their servers. The warning came shortly before the patches went out.

The flaw, known as PHP2Shell, lets attackers run code remotely on vulnerable PHP servers without having to log in or prove identity. PHP dates back to the 1990s. The language lets websites handle requests and run functions on the server. W3Techs says just under 70% of websites running a known server-side programming language rely on PHP.

In mid-August, researchers from AI company Calif and from Wiz, Google’s cybersecurity firm, found weaknesses in PHP installations that handle web requests. Calif’s team found two vulnerabilities. Each one carries a severity rating of 9.2 out of 10. Attackers might use them to steal data, reach sensitive information, or gain control over part of a vulnerable system.

AI tools helped the researchers identify the weaknesses. Calif’s team used OpenAI’s GPT-5.6 Sol model. Wiz researchers used Wiz Atlas, Google’s Gemini 4 Argon, and GPT-5.6 Sol.

Before the PHP Foundation published the fixes, code claiming to exploit the PHP2Shell flaw on any server appeared on GitHub. Microsoft owns GitHub. On Wednesday, Amazon Threat Intelligence said its systems had detected an attempted PHP2Shell exploitation on Saturday.

On Tuesday, Calif accidentally posted a video that demonstrated a proof-of-concept exploit — a demonstration of how the attack works. The clip showed how the exploit worked and was removed later.

Suiche said his team at Tolmo needed less than 24 hours to produce a working exploit. Suiche said AI let his team recreate the flaw on its own systems quickly, work that might have taken several weeks without current AI models. He called the urgency around the threats something new, and said AI tools are helping both cybersecurity teams and attackers find weaknesses and act quickly.

Mihail Kirov of Tolmo, who worked at Quarkslab, said his team found a vulnerability sharing PHP2Shell’s root cause. The foundation knew about the older flaw, yet it did not patch the flaw at the time. In a Wednesday blog post, the foundation called the delay a structural failure, blaming decisions made by its security team and a lack of resources. Details about the flaws circulated on online forums before the planned patch release.

Elizabeth Barron, executive director of the PHP Foundation, said the organization was monitoring the situation Wednesday afternoon. She said no one had observed working exploits at that time, and called publicly generated examples of the exploits incomplete, misguided, and non-working.

Suiche called PHP a legacy server language and said organizations that use it may lack sophisticated security measures. He said city governments and public agencies often run PHP, and administrators may not have updated their websites for 10 years. He said older government sites may hold critical data or provide access to it, so an attack could put sensitive public-sector information at risk.

Experts said applying patches does not, by itself, reveal whether attackers had already compromised a server before the updates, and companies might need to examine their own systems to determine whether attackers reached sensitive data. Ziv said organizations might struggle to spot suspicious requests without an application security platform — tools that monitor applications for attacks — already in place, leaving some exploit attempts unnoticed. Suiche said a company might discover a breach only after its valuable data appeared for sale on the dark web.

Experts said AI helps hackers find and exploit software weaknesses faster than before, cutting the time needed from weeks or months to hours. Ziv said attackers once spent weeks finding and exploiting a new vulnerability online, then days, and since the Mythos era of April 2026, that window can shrink to hours. In April 2026, Anthropic let a limited group of companies and government agencies test its Mythos model so they could assess its cybersecurity capabilities before any wider release.

PHP’s broad adoption, flaws that let attackers run code without signing in, and AI speeding up attacks drive PHP2Shell risk. The NSA says organizations should install the updates immediately or disconnect their servers. Experts said organizations should also watch their servers and check for access that happened before organizations applied the fixes.