The vulnerability endangering millions of websites: How did it happen and what should be done now?

Two critical security vulnerabilities in PHP software, named PHP2Shell, were discovered using AI after years of hiding in the code. They allow attackers to take over servers without a password. PHP powers about 70% of websites worldwide, including WordPress, Drupal, and Joomla, as well as government sites and online stores. Researchers from Wiz, Calif, and OpenAI reported the flaws in August, but a leak of early information led to the early release of patches on October 21. Amazon detected exploitation attempts as early as October 17. Experts warn that in the AI era, the time between vulnerability discovery and exploitation has shrunk to just hours. The recommendation is to update PHP versions immediately and check for intrusions.

Two critical security vulnerabilities in PHP software, named PHP2Shell, were discovered using AI tools after hiding in the software for years. The vulnerabilities allow an attacker to execute commands on a remote server without authentication. PHP powers about 70% of websites worldwide, including WordPress, Drupal, and Joomla, as well as government sites and online stores. Researchers from Wiz, Calif, and OpenAI reported the vulnerabilities in August, but a leak of early information led to the early release of patches on October 21. Amazon detected exploitation attempts as early as October 17. Experts warn that in the AI era, the time between vulnerability discovery and exploitation has shrunk to just hours. The recommendation is to update PHP versions immediately and check for intrusions.