PHP2Shell Flaws Trigger Emergency Patch Advice

Two major security vulnerabilities in PHP, a programming language used by as many as 70% of websites worldwide, were disclosed on a public forum, and the PHP organization confirmed they are real, according to digitaltoday.co.kr.

The flaw, called PHP2Shell, lets an attacker run arbitrary code remotely on a server without authentication or read process memory. Affected versions are PHP 8.2.34, 8.3.35, 8.4.26, 8.5.11 and earlier, plus all end-of-life PHP 8.1 and below, including 7.x and 5.x. PHP recommends updating immediately to patched versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12.

Agencies warn and sites block access

KISA, CISA, the UK NCSC and EU CERT-EU advised updating or warned about the risk. The NSA advised companies that cannot patch immediately to take their services down. The Atlantic reported that European government agencies, hospitals, schools and sites including Rotterdam port, Paris police and 4chan blocked access to avoid being hacked.

Wiz found the vulnerability using its Wiz Atlas security AI agent together with Google Gemini 4 Argon and OpenAI GPT-5.6 Sol, while Calif found one of the PHP flaws through OpenAI's Patch the Planet project using GPT-5.6 Sol. The Node.js team disclosed several high-severity vulnerabilities on the same day the PHP flaws were published.

The vulnerability had gone undetected for over 10 years until AI tools found it. Over the past year the number of software vulnerabilities found each month has doubled, and the time from discovery to exploitation has fallen to weeks or hours in some estimates.