Governments, companies, and organisations worldwide have launched urgent efforts to address critical security vulnerabilities discovered in PHP, a programming language that supports approximately 70 percent of the internet’s websites. The flaws, known as "PHP2Shell," were found earlier this year during a source code audit conducted with the aid of artificial intelligence (AI) tools developed by OpenAI and Google. Security experts have described the vulnerabilities as among the most severe in software history due to their potential for remote code execution, allowing hackers to take control of affected servers without needing passwords or login credentials.

The vulnerabilities had remained undetected in PHP’s source code for more than a decade until AI-assisted researchers from cybersecurity firms Calif and Wiz uncovered them in parallel investigations. Ryan Austin of Calif, who used advanced OpenAI models, reported that exploiting the flaw could enable attackers to hijack websites within seconds to hours, depending on system complexity. This capability poses significant risks ranging from theft of personal data to the installation of backdoors that could grant ongoing access.

Following a coordinated effort involving international cyber experts, software distributors, and government agencies, PHP developers prepared a comprehensive patch comprising fixes across nearly 200 files. The scheduled release of this update on October 22 was expedited after details of the vulnerability leaked publicly two days prior, prompting many organisations to temporarily take their websites and applications offline to mitigate risk.

In response to the disclosure, multiple governments and security bodies, including the US National Security Agency, the UK's National Cyber Security Centre, the European Union’s cybersecurity service, and authorities in Hong Kong, Singapore, Australia, and China, issued strong advisories urging immediate patching or temporary isolation of vulnerable systems. Despite precautionary shutdowns affecting various public services—such as 32 UK government portals and multiple government sites in the Netherlands, Belgium, Japan, and Australia—officials reported no confirmed cyberattacks exploiting the vulnerabilities at the time of the announcements.

Security firms, including Cloudflare, reported detecting millions of attempted hacks targeting the flaw shortly after its public disclosure. Experts caution, however, that organisations should also verify whether breaches occurred before patching, as attackers who gained entry might have compromised passwords or cryptographic keys, allowing future access despite fixes.

The discovery reignites concerns about the dual-edged impact of AI in cybersecurity. While AI accelerates the identification of hidden vulnerabilities that human analysts might miss, it simultaneously speeds up the creation of exploit tools by malicious actors. This dynamic intensifies the race between defenders and hackers, compressing response times from weeks to hours and demanding rapid, coordinated action from organisations worldwide.

Industry analysts and government advisors emphasize that this event should serve as a wake-up call for businesses, particularly smaller entities and sectors with less mature cybersecurity measures, to enhance protocols and maintain robust patching and monitoring systems. The crisis also highlights the need for broader preparedness strategies, with some experts advocating for national frameworks akin to those used in biological security to manage emerging AI-driven threats.

While cautious optimism remains due to the absence of confirmed large-scale breaches, cybersecurity professionals warn that this incident is likely an early example of the escalating cyber risks tied to AI’s growing role, urging continued vigilance and investment in defensive capabilities.