PHP2Shell flaws expose the old code behind 7 in 10 websites (opens the source in a new tab)
- Two flaws called PHP2Shell, disclosed on Wednesday, sit in the part of PHP that handles crashes. PHP runs WordPress and about 7 in 10 websites, and the bug opens a server before a site's own code or firewall runs.
- AI found them: security firm Calif, using an OpenAI model, caught the first in August, and Wiz found both two weeks later. Cloudflare saw millions of attack attempts by the night of the announcement.
- Patches exist for PHP 8.2 to 8.5, but about 7.5 lakh of roughly 5 million PHP servers run versions with none. Finland, Wikipedia and Japan's tax agency took services offline. Pravin Kaushal argues the lasting fix is funding PHP's few maintainers.
- 7.5 lakh
- PHP servers on versions with no patch
- 7 in 10
- websites that run on PHP
Why it matters AI now finds deep bugs cheaply, and so can attackers. Unread old code running banks, shops and government portals has turned from a saving into a liability.
Other side The same AI tools that found PHP2Shell can help defenders audit and patch faster. Funding maintainers helps, but site owners who never update stay exposed however well PHP's team is paid.