Millions of Hacking Attempts: 5 Questions About a Critical Network Vulnerability Discovered by AI

Artificial intelligence helped uncover a critical vulnerability in PHP—a programming language used by millions of web servers around the world. Approximately 70% of websites were affected.

The disclosure of the vulnerability has sparked a race between cybersecurity experts trying to roll out patches as quickly as possible and hackers who are using AI to find ways to exploit the vulnerability, according to The Wall Street Journal. Due to the threat of attacks, several European countries temporarily shut down government websites and online services as a precautionary measure, Reuters reports. Cloudflare, a company that provides protection against DDoS attacks, recorded “millions” of attempts to hack websites after the vulnerability was publicly disclosed.

Two separate groups of researchers independently discovered vulnerabilities in servers running operating systems that use PHP. Ryan Austin of Calif identified the issue back in August while auditing the PHP source code using OpenAI’s GPT-5.6 Sol. The same software flaws were found by the cybersecurity team at Wiz, a division of Alphabet: its researchers used their own autonomous system, Wiz Atlas, as well as Google’s Gemini 4 Argon and GPT-5.6 Sol. Calif and Wiz then coordinated with PHP developers and OpenAI researchers to test ways to exploit the vulnerabilities and prepare fixes.

The problem had existed in the PHP code for many years, but was previously considered practically impossible to exploit until the advent of AI, notes The Wall Street Journal.

The vulnerability has been named PHP2Shell. It is related to how PHP manages server memory. Specially crafted requests to a website allow a hacker to execute their own code on the server. Austin discovered how, using just a few dozen specially crafted requests to the server, he could gain control over the code running in its memory. On small systems, such an attack can take a matter of seconds; on more complex ones, it can take several hours.

At the same time, a malicious AI doesn't necessarily need to steal the administrator's password or hack into the control panel: a vulnerable version of PHP can be tricked into running an unauthorized program and handing over full control of the server.

PHP2Shell has been assigned a CVSS severity score of 9.2 out of 10, Reuters notes. The scale of the risk is linked to the widespread use of PHP. This language is used for the server-side of a vast number of websites and powers popular content management systems such as WordPress, Drupal, and Joomla. Reuters estimates that it accounts for approximately 70% of websites for which the server-side language can be identified.

“All servers running any version of PHP released in the past 20 years will be vulnerable,” Tiffany Farris, acting CEO of the Drupal Association, told Reuters. “This issue affects a large part of the internet.”

According to Wiz co-founder Ami Luttwak, PHP2Shell is “the most serious AI vulnerability ever discovered” and was likely too complex to have been found without artificial intelligence. But that same ability of AI to dramatically speed up the search for ways to exploit bugs also works in the favor of attackers: once a patch is released, attackers can quickly compare the old and new code, figure out exactly what the developers fixed, and help create a working exploit (attack code) for servers that haven’t had time to update yet. That is precisely why the patches were developed in secret, and after the information leaked to Hacker News, the developers expedited the release of the security updates.

“Some guy on Twitter could take these patches, run them through AI, and post a script to exploit the vulnerability. And then all hell would break loose,” Calif CEO Tai Duong told the WSJ.

The risk is particularly high for small websites run by individuals or organizations with limited technical resources, according to Reuters. Many of them are hosted on shared hosting services, where customers do not directly manage the underlying server infrastructure. According to cybersecurity experts, such sites may take longer to install patches, so they may remain vulnerable long after fixes have been released, the agency explains.

AI has become the driving force behind the “race to exploit” vulnerabilities, Kostin Raiu, co-founder of the cybersecurity research and incident response firm TLP, told Reuters. According to him, the next stage could be “a massive hack of every vulnerable web server on the internet.”

Cybersecurity agencies in Europe, Australia, Japan, and the United Kingdom have urged PHP users to immediately update their software or take their websites offline until patches are installed, Reuters reports. The Dutch cybersecurity agency temporarily took its website offline, stating that it did so as a precautionary measure due to the discovered vulnerabilities. The operator of the online encyclopedia Wikipedia also reported that it had taken an unspecified number of systems offline until patches could be safely installed on them.

In the Netherlands, the government portal Overheid.nl, the Rotterdam city website, the websites of the national soccer association (KNVB), the five largest political parties, and several hospitals also went offline. In Denmark, the municipal IT company Kombit suspended several services, including the national school communication platform. In Finland, the government IT provider Valtori shut down public network services, and the French Ministry of the Interior placed all its websites into preventive maintenance mode. In Japan, the cloud provider Sakura Internet suspended one of its database functions.

Cloudflare, an American company that helps websites run faster, protects them from cyberattacks, and makes them more reliable, reported that while it had recorded “thousands” of attempts to hack websites before the vulnerability was disclosed, the number jumped “to millions” afterward.

The disclosure of PHP2Shell boosted the stock prices of companies that stand to benefit from increased demand for website and server security. Cloudflare’s stock jumped 5.3%. The company was directly involved in preparing for the disclosure of the vulnerability and had already implemented protections for customers of its Web Application Firewall—a system that filters incoming traffic and blocks attempts to attack web applications.

CrowdStrike shares rose by about 5.3%, while Palo Alto Networks shares rose by 2%. Both companies specialize in enterprise cybersecurity and could potentially benefit from a new wave of spending on infrastructure protection. On October 21, CrowdStrike separately announced an expansion of its partnership with Nvidia in the area of AI agent protection.

Fastly shares rose about 5.6%, while Akamai shares rose 0.7%. Both companies were directly involved in developing defensive measures to address the PHP2Shell issue.

The First Trust Nasdaq Cybersecurity ETF rose 2.5% on October 21, while the Nasdaq Composite technology sector index gained only 1%.

This article was AI-translated and verified by a human editor