UK checks exposure after AI-discovered critical PHP flaws spark global scramble
The UK government said it is working to identify any potential exposure in its online services after critical cyber-security flaws were found in PHP, the programming language underpinning a significant number of the world's websites. According to the BBC, the flaws were first discovered by AI and went undetected for at least a decade; the UK's National Cyber Security Centre, along with EU and Australian counterparts, urged PHP users to apply fixes, and the NSA said the flaws often provide a direct path to a server's file system or database. Amazon said it detected a "PHP2Shell exploitation attempt" on 17 October against a honeypot system and further attempts on 21 October that varied in payload and anonymisation infrastructure, occurring after details leaked on social media but before an embargo was lifted.
The incident is a reported case of AI-discovered vulnerabilities reaching active exploitation within days, with OpenAI calling it "one of the most impactful security issues in recent memory" and Wiz estimating roughly 70% of the internet is affected, a figure the BBC could not independently verify.
Hackers have made millions of attempts to exploit PHP2Shell since Wednesday’s disclosure, Cloudflare’s chief executive, Matthew Prince, said on X. Officials in Germany, the Netherlands and Japan say they have not seen one succeed.
Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now. — Matthew Prince 🌥 (@eastdakota) October 22, 2026
#PHP#PHP Foundation#Amazon#UK National Cyber Security Centre#National Security Agency#OpenAI#Wiz#Wikipedia#Australian Council on AI Strategy