In August, researchers at Calif used an advanced OpenAI model to uncover a deep flaw in PHP, the server-side language estimated to underpin roughly 70% of websites. The vulnerability, later dubbed PHP2Shell, could let an unauthenticated attacker run commands on an unpatched web server—putting data, websites and wider networks at risk.¹

The finding initially followed the familiar logic of coordinated disclosure: researchers alerted the PHP community while a patch was prepared. But information began circulating before the planned release. The PHP Foundation said Chainguard had “unilaterally broke the embargo,” while Chainguard chief Dan Lorenc argued he acted because exploitation was already under way—a dispute that exposed the fragile judgment calls behind modern vulnerability disclosure.²

By Wednesday, the patch was out, but so was the panic. Cloudflare detected thousands of exploit attempts before public disclosure; within 45 minutes, the count had reached tens of thousands, then hundreds of thousands within two hours and eventually millions. Those were attempts rather than proof of mass compromise, but the speed drove governments and companies to pull services offline while they updated.³ A reposted alert said successful exploitation had been observed on honeypot servers, with attackers issuing shell commands to retrieve additional payloads.Aravind Srinivas (AravSrinivas)⁴

The disruptions were tangible. Britain took 32 government services offline as a precaution; public websites in Finland, Germany, Japan and the Netherlands were also affected. For large organizations, the outage could be a “speed bump,” one small-business provider said, but some smaller firms remained offline for as long as seven hours.³

Security officials see the incident as more than a bad week for PHP. AI can inspect immense codebases and find bugs humans missed for years, yet the same capabilities can help less-skilled attackers move from disclosure to exploitation in minutes. Germany’s cyber agency called taking sites offline a “really a drastic measure,” but said AI’s acceleration meant “we had to do that.”²

The practical consensus was blunt: patch fast. The Dutch cyber agency’s advice was “patch, patch, and patch.”² New tools quickly appeared to help administrators check exposure, including an offer of credits for PHP vulnerability checks.Aravind Srinivas (AravSrinivas)⁵ The immediate crisis may have eased, but the race between automated discovery and automated abuse has plainly intensified.