A bug that allows hackers to remotely execute code has been discovered in PHP, the language that powers 70% of the world’s websites.

PHP shipped emergency fixes today for two of the most critical flaws, but over one-third of the web remains unpatched as of publication time.

The language, used to program website backends, runs on servers, not in the browser, and sends its resulting HTML or other dynamic data to the browser.

Official fixed releases only cover PHP 8.2 and newer, leaving over one-third of PHP websites without a patch.

Mid-day, backports were starting to roll out across older versions 7.4-8.1. Unfortunately, according to one estimate, more than 800,000 internet hosts serving content to millions of websites run a branch of PHP so old “that will get no fix” at all.

PHP2Shell lets an unauthenticated attacker run code on a web server and serve buggy outputs to a user’s browser.

A security researcher using OpenAI’s GPT-5.6 Sol model discovered the bug during an August audit funded by OpenAI.

That researcher was part of Calif, a partner in OpenAI’s Patch the Planet program, which pairs frontier models with expert human cybersecurity review.

The bug class had been flagged decades earlier yet dismissed as too hard to exploit, Calif’s CEO Thai Duong told the Wall Street Journal.

However, AI hackers have now figured out how to seize control of a server’s memory within a few dozen requests.

Wiz, a division of Google Cloud, confirmed the flaws independently. Wiz’s co-founder called PHP2Shell “the most severe AI vulnerability that was ever found,” and one humans would probably never have found.

Source link