Researchers at Calif used an advanced OpenAI model in August to uncover a deep flaw in PHP, the web language estimated to run roughly 70% of sites. The bug, later dubbed PHP2Shell, could let an attacker execute commands on an unpatched server and seize its data or controls.¹

The discovery initially followed the established playbook: report privately, prepare a fix, then disclose. But that timetable fractured when details circulated before the PHP Foundation’s planned release. The foundation said Chainguard had “unilaterally broke the embargo”; Chainguard CEO Dan Lorenc later said he acted because he believed the flaw was already being exploited.²

By Wednesday, the theoretical risk had become an operational emergency. The PHP Foundation released a patch, while governments and businesses took services offline rather than gamble with exposure. Britain shut 32 government services as a precaution; public portals in Finland and the Netherlands went dark, and Japan’s prime minister urged companies to do likewise.³

The pressure came from the speed of the attack traffic. Cloudflare saw thousands of attempted exploits before public disclosure, then tens of thousands within 45 minutes, hundreds of thousands within two hours and eventually millions. Those were attempts—not proof of mass successful breaches—but they made delay look dangerous.⁴ Aravind Srinivas, meanwhile, promoted free credits for a tool to check PHP sites and deployment configurations for exposure, a sign of the rapid market response around remediation.Aravind Srinivas (AravSrinivas)⁵

For security teams, the incident sharpened the central contradiction. AI helped surface a flaw that had lived in core PHP code for more than a decade; the same tools can help attackers find targets and automate exploitation. One cybersecurity expert warned that the old sequence—scope the exposure, draft a plan, assign the fix—is “broken” when low-skilled attackers can move within minutes.⁶

The practical consensus is less dramatic: identify exposed systems, install the PHP update, and isolate systems that cannot be patched immediately. As the Dutch cyber agency’s Matthijs van Amelsfort put it, the immediate prescription is simply “patch, patch, and patch.”²