The fallout from the PHP2Shell vulnerability has escalated into one of the internet's largest coordinated emergency responses in years, with governments pulling websites offline as a precaution and security firms reporting millions of exploitation attempts against websites running the PHP programming language, which underpins roughly 70 percent of the world's sites.
Millions of Exploit Attempts Within Hours For more context on this story, see our ongoing more AI stories.
According to The Guardian, Cloudflare CEO Matthew Prince said his company recorded tens of thousands of exploitation attempts in the first 45 minutes after the vulnerability became public, rising to hundreds of thousands within two hours and "millions now." Cloudflare also reported seeing thousands of attempts in the 10 hours before the flaw was publicly announced, a detail that has fueled concern about how the disclosure was handled.
Amazon Threat Intelligence said PHP2Shell is "now being broadly exploited in the wild" and that it identified several attempts from multiple actors to find ways to capitalize on the vulnerability even before PHP developers released the fix on Wednesday. Security professor Alan Woodward of the University of Surrey told the newspaper that the flaw was revealed a day before the patch was available, saying "somebody let the cat out of the bag."
Governments Take Sites Offline to Patch
The response has been unusually drastic. In the United Kingdom, cybersecurity minister Liz Lloyd told Parliament that 32 government services had been taken offline, describing the move as largely precautionary while updates were applied. Downing Street said no public-facing critical services had been affected and that some limited services might be temporarily unavailable, but stressed this did not mean they had been hacked.
The UK's National Cyber Security Centre sent 50,000 alerts to affected organizations and said it had received no reports of successful hacks. The agency described the scale of the vulnerability as "unprecedented" and warned that the patch will not work for some organizations running older systems, which will need to replace them entirely. Sites reportedly affected by temporary outages included the BBC's Traitors show website, the Internet Archive, Wikipedia and 4Chan.
In the United States, the National Security Agency issued an advisory warning that the flaw could let attackers seize control of web servers, steal sensitive data, disrupt services and move deeper into compromised networks. "Cyber-actors are likely to weaponise PHP2Shell," the agency said, adding that the risks "are serious enough to require immediate patching across US government departments and agencies."
The emergency response crossed borders quickly. South Korea activated emergency response measures, raised its private-sector cybersecurity alert level and issued guidance to tens of thousands of companies. China's industry ministry urged organizations to inspect their systems, upgrade to the latest secure version of PHP and change passwords and keys. Japan's Prime Minister encouraged businesses to patch the vulnerability or shut down their sites.
Why PHP2Shell Is Being Called Historic
Ciaran Martin, the former chief executive of the NCSC, described the flaw as "very bad" and "the most serious vulnerability discovered for five years." Wiz, one of the research organizations that uncovered the vulnerability, has said it is arguably among the most severe software flaws ever discovered.
The vulnerability's origin is what makes it a landmark for AI security. According to Wiz, the underlying PHP flaws had been present for decades, but demonstrating that they were actually exploitable required an exceptionally complex chain of steps at the edge of what human researchers could practically achieve. "Frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit," the company wrote in its blog post.
The NSA's warning centers on what attackers could do with access. Internet infrastructure expert Michał Woźniak told The Guardian that hostile actors could "grab the resources" of exposed sites, since major websites control valuable computing power, servers and IP addresses. Criminal groups could nest inside compromised sites to launch attacks that cannot be traced back to them, while crypto miners could hijack servers to run energy-intensive calculations for free. In many cases, he noted, site owners would not even be aware of the compromise.
A Note of Caution Amid the Alarm
Not everyone believes the damage is done. Ryan Austin, a researcher at cybersecurity company Calif who was key to discovering the flaw, told The Guardian that "at the moment it doesn't look like exploitation has taken off or been widespread." The British Chambers of Commerce said the disruption had not yet caused significant difficulties for UK firms.
Former GCHQ chief Sir David Omand, however, warned that state adversaries including Russia and China could seek to exploit the bug before defenses are fully in place, a reminder that the window between disclosure and full remediation is when the internet is most exposed.
What Site Operators Should Do Now
For organizations still exposed, the guidance from agencies is consistent: upgrade to the latest patched version of PHP immediately, verify that patches applied cleanly, and where systems are too old to accept the fix, isolate or replace them. The NCSC's warning that some legacy systems cannot be patched at all suggests the long tail of this vulnerability will persist well beyond the current emergency.
The episode also settles a debate about AI-assisted offensive research. What was theoretical a week ago is now a live global incident: an AI system found a way to weaponize bugs that sat unexploited for decades, and every government on the internet is now spending its week cleaning up.
---
Stay Ahead of AIGet the latest AI news, analysis, and breakthroughs — all in one place.
Read more AI news →
