The vulnerabilities had remained hidden in the PHP codebase for more than a decade before being identified. The discovery marks a significant shift in cybersecurity, as researchers from OpenAI, the Google-owned security firm Wiz, and the company Calif utilized advanced AI tools to locate the bugs. According to Wiz, the process involved using Google’s Gemini 4 Argon, Wiz Atlas, and OpenAI’s GPT-5.6 Sol. The firm described the event as an “AI inflection point,” noting that a single researcher used these tools to complete in one week what previously would have taken a world-class team months of work to achieve.
The US National Security Agency and Europe’s cybersecurity agency issued urgent advisories on Wednesday, urging organizations to apply the fix released by the PHP Foundation immediately. The bugs were first discovered in late August but were only disclosed publicly on Wednesday after a patch was finalized. In response, Japanese Prime Minister Sanae Takaichi advised companies to consider suspending services to reduce exposure, while Dutch Prime Minister Rob Jetten stated his cabinet was closely monitoring the situation. Major institutions, including Japanese airline ANA, railway operator JR West, and bank MUFG, temporarily suspended web services. In Europe, government sites in France, Denmark, Finland, and the Netherlands, along with the Dutch cybersecurity agency, went offline during the patching process.
Wikipedia’s operator, the Wikimedia Foundation, confirmed it was addressing the vulnerabilities and took systems down as a precautionary measure. Similarly, Irish news outlet The Journal, the country’s second most-used online news source, went offline on Thursday morning to bolster its defenses. Cloudflare, which collaborated with the PHP Foundation and security researchers, confirmed the severity of the flaws. Wiz compared the potential impact of PHP2Shell to the 2014 Heartbleed bug, a major vulnerability in encryption technology, while OpenAI labeled it one of the most impactful security issues in recent memory.
The incident highlights the growing dual-use nature of artificial intelligence in cybersecurity. While AI accelerated the discovery and remediation of these long-standing bugs, it also demonstrates how frontier models can rapidly convert code weaknesses into working exploits. As operators continue to deploy the PHP Foundation’s patch, the focus remains on ensuring all public-facing systems are updated to prevent potential exploitation of the now-closed vulnerabilities.
