GoKawiilPHP vulnerability dubbed 'PHP2Shell' prompts NSA warning and website shutdowns
Researchers at AI firm Calif and Google's Wiz discovered a set of vulnerabilities, dubbed PHP2Shell, affecting all PHP installations serving web requests, using AI tools including OpenAI's GPT-5.6 Sol and Google's Gemini 4 Argon. The flaws allow unauthenticated attackers to remotely execute code on PHP servers, prompting the NSA to urge organizations to patch immediately or take servers offline, and causing some European government websites to go dark. A proof-of-concept video accidentally posted by Calif leaked details early, forcing the PHP Foundation to fast-track patches originally planned for release a day later.
GoKawiil's interpretation of the reporting above, not reported fact.
The episode illustrates how AI tools are speeding up both the discovery of software flaws and the window attackers have to exploit them, according to researcher Matt Suiche, who says such urgency around patching did not exist a year ago. Because PHP underpins a large share of the web, unpatched servers could expose significant amounts of sensitive data if exploited widely. The accidental leak of exploit details also highlights new risks around how security researchers handle sensitive findings in an AI-accelerated research environment.
- PHP2Shell vulnerabilities affect nearly all PHP server installations, a language used by about 70% of websites with known server languages.
- The NSA urged immediate patching or taking servers offline, and some European government sites went down as a precaution.
- AI tools used by researchers to find the flaws may also be shortening the time attackers need to exploit similar vulnerabilities, according to a cybersecurity researcher.
Source: cnbc.com — Isabel O'Brien, 2026-10-22
Published there as: “Why governments pulled websites offline over the decades-old PHP programming language”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.