Critical security vulnerability discovered in PHP programming language threatens websites worldwide

A critical security vulnerability termed 'PHP2Shell' has been detected in the PHP programming language, which is used in approximately 70% of websites and applications worldwide. Security researchers uncovered the flaw—which has apparently existed for at least a decade—in code analyzed using an OpenAI artificial intelligence model.

The PHP2Shell vulnerability allows attackers to seize control of unprotected servers, upload malware, and steal sensitive customer data. Voldemaras Kadys, head of the Mediatech security unit, stated that the impact could be extremely broad due to PHP's widespread use by government agencies, social media platforms, and online retailers.

Andrés Guerrero-Saade of SentinelOne noted that this incident demonstrates how artificial intelligence accelerates both the discovery of security vulnerabilities and the attack capabilities of cybercriminals. While the PHP Foundation urged system administrators to update immediately, the FBI recommended that organizations unable to apply the patches immediately take their sites temporarily offline.