According to reports, the widely used open-source programming language PHP has been found to contain two critical vulnerabilities collectively dubbed "PHP2Shell," which could allow hackers to execute malicious code remotely and expose sensitive data.
The flaws had remained hidden for years until they were discovered with the help of AI. PHP developers released emergency fixes on Wednesday and urged users to update immediately.
Cloudflare's CEO stated that thousands of exploitation attempts were already seen across the internet 10 hours before the vulnerabilities were disclosed, surging to tens of thousands within 45 minutes of the announcement, hundreds of thousands within two hours, and now reaching millions.
Government websites in Europe and elsewhere were taken offline, while Japan's Mitsubishi UFJ Financial Group and the Japanese Ministry of Finance suspended some services.
The U.S. National Security Agency and the Federal Bureau of Investigation issued warnings, with Google, OpenAI, and Amazon participating in vulnerability discovery and protection efforts. The incident highlights the double-edged sword of AI in both attack and defense, as well as the systemic risks of open-source software.
Long-Hidden PHP Flaws Uncovered by AI, Global Scramble to Patch
According to multiple foreign media reports, the widely used open-source programming language PHP has been found to contain two critical vulnerabilities collectively known as "PHP2Shell." The flaws could allow hackers to execute malicious code remotely and potentially expose sensitive server data.
PHP developers released emergency fixes on Wednesday, saying the vulnerabilities had lurked for years until AI helped uncover them, and "encouraged" all users to update immediately. Google, OpenAI, and Amazon all took part in vulnerability discovery, attack detection, or system protection.
The U.S. National Security Agency urged organizations using PHP to prepare security updates, warning that the flaws could give attackers direct access to server file systems and databases; if immediate updates are not possible, it recommended taking affected systems offline. The FBI also warned that malicious actors could exploit the vulnerabilities to execute code remotely.
Cloudflare CEO Matthew Prince posted on X on Wednesday night that thousands of exploitation attempts had appeared across the internet 10 hours before public disclosure; within 45 minutes of the announcement, that jumped to tens of thousands, reached hundreds of thousands within two hours, and has now reached millions. Amazon said its MadPot threat detection system detected exploitation attempts before public disclosure, though it remains unclear how attackers learned the information in advance.
Analysts noted that the interval between disclosure and large-scale exploitation is shrinking rapidly, challenging the traditional "disclose first, patch later" emergency response rhythm.
Global Response: Government Sites Offline, Financial Institutions Halt Some Services
Government websites in Europe and other regions went offline on Wednesday as website operators worldwide rushed to secure their systems. Japan's Mitsubishi UFJ Financial Group said it temporarily suspended some internet services as an emergency measure; Japan's Ministry of Finance temporarily suspended some website content and services while implementing security measures; Japanese Prime Minister Sanae Takaichi urged website owners to check whether they use PHP and prepare to apply fixes.
Cloudflare said it has deployed protections against PHP2Shell through its Web Application Firewall. Google said its Wiz cybersecurity unit used AI models to discover and investigate the vulnerabilities, with Gemini helping assess the flaws, test attack paths, and verify fixes; OpenAI said researchers used its AI models to help find the vulnerabilities, coordinating fixes and preparing protections over the past two months.
Market participants believe the incident will, in the short term, reinforce corporate spending expectations in areas such as cloud security, Web Application Firewalls, threat intelligence, and patch management, and that attention on the cybersecurity sector is likely to rise. In the medium to long term, AI is changing the efficiency of vulnerability discovery, but similar capabilities could also be exploited by cybercriminals, lowering the barrier to attacks.
For investors, the systemic risks brought by the widespread use of open-source software make corporate patch management and emergency response capabilities important indicators of operational resilience; for regulators, critical infrastructure's reliance on open-source components may drive stricter disclosure and protection requirements. The incident once again shows that "AI security" is moving from concept to刚性 spending, and open-source governance will also become an important variable in valuation and risk assessment.
Comments