PHP vulnerability triggers global patch scramble — SkimNews
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- PHP vulnerability discovered after existing for decades puts tens of millions of websites at risk, particularly those using WordPress and Drupal content management systems.
- OpenAI and Wiz researchers participating in the Hack the Planet initiative identified the PHP flaw using AI tools to exploit the bug, though the discovery itself was made by human researchers.
- Sean O’Kane called the incident a 'reckoning moment' that reveals how core internet infrastructure is 'held together by glue and dreams,' especially as AI agents make finding such flaws easier.
- Kirsten Korosec highlighted the scale of exposure, noting many site owners don’t even know they’re running PHP, increasing the risk of unpatched systems and widespread link rot from site takedowns.
- Amazon detected exploitation attempts via its honeypot network before the vulnerability was publicly disclosed, underscoring the speed at which attackers move once flaws are known.
- Matthew Prince observed millions of attempted PHP2Shell attacks in real time, signaling a race between defenders patching systems and hackers weaponizing the flaw.
Why it matters: The disclosure forces immediate action on a decades-old flaw in software underpinning 70% of websites, but the lack of clear ownership and patching capacity means smaller sites and governments face disproportionate risk of compromise or permanent takedown, widening the digital security divide.
Ask SkimNews
