Why a PHP bug is a business risk, not just an IT problem: ‘Next step could be the mass compromise of…’

A critical vulnerability in PHP, a programming language that powers a large share of the internet, has forced government agencies and organisations across Europe to take websites and online services offline, pointing to the business risks posed by security flaws in widely used software.

The vulnerabilities, which remained hidden in PHP's code for more than a decade, were discovered with the help of artificial intelligence (AI). Developers released emergency fixes on Wednesday, urging users to update immediately as cybersecurity firms warned that hackers were already attempting to exploit the flaws.

PHP underpins about 75% of websites whose programming language can be identified, according to web technology tracker W3Techs. It is also embedded in widely used content management systems, including WordPress, Drupal, Joomla and Magento, exposing a vast number of websites to potential disruption.

Quick answers to key questions

•5 QUESTIONS

1

What is the PHP2Shell vulnerability?⌵

PHP2Shell refers to critical flaws in PHP’s core engine that could let attackers run malicious code remotely and expose sensitive server data. The vulnerabilities are in PHP, not specifically in WordPress, Drupal or Joomla.

2

Which websites are at risk from the PHP vulnerabilities?⌵

Websites and services running affected PHP versions may be vulnerable, including sites built with widely used content management systems such as WordPress, Drupal, Joomla and Magento. The flaws affect PHP itself rather than those platforms.

3

Why can a PHP bug become a business risk?⌵

Organisations may lose access to websites and online services if they take systems offline to prevent attacks or apply security fixes. This can disrupt services used to communicate with customers or provide public services.

4

How did AI change the risk from the PHP vulnerabilities?⌵

Researchers used AI tools to help find and investigate the flaws, tasks that could otherwise require extensive manual work. Security experts warned that AI could also make it easier for attackers to exploit vulnerabilities at scale.

5

What should website operators do about the PHP vulnerabilities?⌵

Identify whether their systems run an affected PHP version and apply the security updates as soon as possible. If a system cannot be updated immediately, authorities advised taking affected systems offline.

The scale of the threat makes the vulnerability more than an IT problem. Organisations that depend on PHP-powered websites to provide public services and communicate with customers face the risk of losing access to essential online systems while they patch their software.

“All servers using any version of PHP released in the last 20 years will be vulnerable,” Tiffany Farriss, interim chief executive of the Drupal Association, told Reuters. "This issue impacts the majority of the internet."

According to internet intelligence firm Censys, about 1.5 million of 2.6 million hosts report running a PHP version for which no fix is available.

The vulnerabilities were discovered independently by cybersecurity companies Calif and Wiz using AI tools. Wiz said the flaws would have been extraordinarily complicated for a human hacker to exploit, but AI has changed the equation.

"Pre-AI, this manual work would be difficult to implement and even harder to scale," Wiz said in a blog post. "With AI, this is no longer a barrier."

Costin Raiu, co-founder of cybersecurity research and incident response firm TLP, described the situation as a "race to exploit" powered by AI. He warned that the next step could be the "mass compromise of every vulnerable web server on the internet."

Amazon's security chief CJ Moses said the company's security team detected an attempted exploit against a decoy system on October 17, four days before public disclosure. More attempts followed on Wednesday, with Amazon saying the vulnerabilities were "now being broadly exploited in the wild."

The immediate response has involved taking systems offline to prevent potential attacks. In the Netherlands, affected organisations included the Port of Rotterdam, government portal Overheid.nl, hospital websites and the websites of the country's five largest political parties.

In Denmark, IT company Kombit shut down several services, including the national school communication platform. Finland's state IT services provider Valtori took government public network services offline, while France's Interior Ministry placed all its websites under preventive maintenance.

Cybersecurity experts warned that smaller websites could face greater risks because their operators may have limited technical resources and rely on shared hosting services.

Lukasz Olejnik, a visiting senior research fellow at King's College London, said AI-assisted hacking campaigns could cause widespread damage to unpatched servers.

"The scale is huge, and with AI, exploitation may happen instantly," Olejnik said.

Sanchari Ghosh is an Assistant Editor at Mint with over 12 years of experience in journalism, specialising in personal finance, DLT & DeFi, geopolitics and foreign policy, with a particular emphasis on how these areas intersect. <br> She writes extensively about how money works in everyday life—helping readers navigate personal finance decisions. <br> As AI reshapes investing behaviour, capital is increasingly flowing into decentralized ecosystems, redefining how assets are managed, traded, and valued. She focuses on explaining how money flows within frameworks like Distributed Ledger Technology (DLT), DeFi protocols, and crypto markets—while also exploring what the future of money could look like in a trustless, programmable financial world. <br> She also focuses on immigration-related issues, simplifying complex topics around visas, passports, overseas financial planning, and the many practical challenges Indians face while moving or living abroad. <br> Alongside personal finance, Sanchari has a strong understanding of international politics, contemporary and historical conflicts, and global state decisions. She closely tracks how geopolitical developments influence economies, markets, and individual financial choices, bringing together finance and global affairs in her reporting. <br> She began her career as a desk editor, which gave her a strong foundation in news writing. Over time, her interest naturally shifted toward personal finance. Before joining Mint in 2020, she worked DNA, The Times of India, Outlook Money, BloombergQuint, and ETMoney. At Mint, she got an opportunity to expand her coverage to include immigration and geopolitical developments while continuing to closely follow personal finance trends and market movements.As a journalist, she is committed to accuracy, intellectual rigour, and fairness. <br> She is an English Major and her work took her across cities including Delhi, Mumbai, and Pune. Living independently from an early age gave her firsthand experience in managing life and money on her own. This practical exposure sparked her strong interest in personal finance. <br> Outside the newsroom, Sanchari is a sports enthusiast who regularly plays lawn tennis and squash. In her younger years, she was also a national-level badminton player.

Catch all the Corporate news and Updates on Live Mint. Download The Mint News App to get Daily Market Updates & Live Business News.

More

✕

Wait for it…

Oops! Looks like you have exceeded the limit to bookmark the image. Remove some to bookmark this image.