Two Critical PHP Flaws Push Governments and Companies to Patch Amid Millions of Exploitation Attempts

Two critical vulnerabilities in the PHP language, known as PHP2Shell, were discovered and could allow remote code execution without authentication on affected servers. This prompted governments and companies to patch their websites, and some temporarily took their sites offline to prevent compromise. Cloudflare recorded millions of exploitation attempts after the vulnerabilities were publicly announced.

AI-written summary of 7 sources; every verified point is backed by a verbatim quote. How Iyan works

• OpenAI said its GPT-5.6 Sol model helped identify one of the two flaws.

  «OpenAI says GPT-5.6 Sol helped identify one flaw.»

  WION
• BBC reported that artificial intelligence discovered the vulnerabilities within PHP, prompting some parties to temporarily shut down their websites.

  «The vulnerabilities were found by AI within the PHP programming language»

  BBC
• Cloudflare CEO Matthew Prince said the company detected millions of exploitation attempts after the vulnerabilities were publicly announced.

  «Cloudflare saw millions of exploitation attempts after the public disclosure of critical vulnerabilities»

  Reuters
• Patabiraman said there are no known cases of the vulnerability being exploited, but its discovery by intruders could have led to the loss of important data.

  «there are no known cases of the vulnerability being exploited at this time»

  The Vancouver Sun
• The statement noted that PHP is used on about 70% of websites.

  «لغة ‏‎«PHP»‎‏ المستخدمة في نحو 70% من المواقع»

  البيان

Iyan — See it for yourself. What changed in your world today, why it matters, and how we know.
How it works • Privacy • Terms