At the heart of this disruption is PHP, the server-side scripting language that powers a vast portion of the internet’s backbone. It is the invisible engine behind platforms as diverse as Wikipedia, online retail stores, and WordPress, the content management system behind countless blogs and news outlets. When a user visits a page like Wikipedia, PHP is the code that collects the necessary information and presents it in a readable format. However, researchers have identified critical flaws in PHP itself, not in the applications hosted upon it, that provide a direct path to a server’s file system or database. According to the US National Security Agency, these vulnerabilities allow attackers to steal sensitive data, disrupt services, or move deeper into a network.
The technological significance of this event lies not only in the severity of the flaw but in how it was found: by artificial intelligence. The PHP Foundation intended to release its discovery later in the month, accompanied by a complete fix, or “patch.” But the sequence of events was altered when details of the flaw were leaked on social media on Tuesday. This leak triggered a cascade of defensive actions and, shortly after, offensive attempts. Amazon announced on Wednesday that it had identified a “PHP2Shell exploitation attempt” on 17 October, targeting one of its decoy or “honeypot” systems. CJ Moses, Amazon’s security chief, noted that the use of an anonymous IP address suggested the activity was conducted by a professional “threat actor.”
The rapidity of the response underscores a fundamental shift in the cybersecurity landscape. Anna-Maria Arabia, CEO of the Australian Council on AI Strategy, told the BBC that the incident “demonstrated how quickly AI is changing our cybersecurity landscape.” She noted that what used to take months to expose a vulnerability is now taking days. “It is not going backwards, in other words,” she warned, indicating that as AI technology improves, such threats will become more commonplace. The use of AI in the discovery process means that “more actors can act within hours or even minutes once technical details of a vulnerability are disclosed,” Moses added. This compression of the timeline between discovery and exploitation poses a significant challenge for organizations that rely on standard patch cycles.
The scale of the potential impact is staggering, though precise figures remain difficult to verify. Cyber-security firm Wiz estimated that “roughly 70%” of the internet is affected by these flaws, though the BBC was unable to independently verify that figure. The vulnerabilities had gone undetected for at least a decade, highlighting the complexity of maintaining security in widely adopted legacy systems. The widespread nature of PHP’s usage meant that the risk was not confined to a single sector or region. The Dutch cybersecurity agency took its site offline as a precaution, while Finland shut down its public web services. Wikipedia also removed parts of its website, following advice from governments, including the US, to take sites down if immediate remediation was not feasible.
The UK’s National Cyber Security Centre (NCSC), along with counterparts in the EU and Australia, urged organizations to apply fixes immediately. For those where immediate remediation was not possible, the NCSC advised taking systems offline until they could be fully mitigated. A UK government spokesperson extended this plea to “all organisations, private and public, large and small,” urging them to follow the guidance to protect their systems. In subsequent attacks on Amazon on 21 October, the “actual payloads and choices in anonymisation infrastructure varied,” suggesting that multiple actors were involved. These attacks occurred after the leak but before the embargo on the PHP warning was lifted, indicating that threat actors were monitoring the situation closely and acting in real-time.
The incident also raised questions about the origin of the attackers’ knowledge. Amazon stated it was unclear how the actors knew about the vulnerabilities before the official disclosure. OpenAI described the discovery as “one of the most impactful security issues in recent memory,” reflecting the gravity of the situation in the broader tech industry. While some websites, such as those for Edinburgh and Oxford councils, went offline on Wednesday, they were later accessible again, suggesting that some organizations were able to apply patches relatively quickly. Other sites, including those for BBC programmes like Doctor Who and The Traitors, remained inaccessible, though the BBC has not confirmed a direct link to PHP.
This global response illustrates the fragility of digital infrastructure when a single foundational technology is compromised. The reliance on PHP for such a diverse range of services, from government data to personal blogs, creates a single point of failure that can have cascading effects. The involvement of AI in both the discovery and the exploitation of these flaws signals a new era in cybersecurity, where the speed of the attack and the defense are becoming increasingly comparable. As organizations work to patch their systems, the focus shifts from mere vulnerability management to the need for more agile, AI-assisted defensive strategies. The next confirmed development will be the widespread rollout of the PHP Foundation’s patch, but until then, the internet remains in a state of heightened vigilance.
