The Zhitong Finance App learned that the widely used open source programming language PHP was revealed to have two key vulnerabilities “PHP2Shell”, which can cause hackers to remotely execute malicious code and expose sensitive data. The bug lurked for many years and wasn't discovered until AI was used. The PHP developers released an urgent fix on Wednesday and urged users to update it immediately. The CEO of Cloudflare said that in the 10 hours before the disclosure of the vulnerability, the entire network had already seen thousands of use attempts. 45 minutes after the announcement, it jumped to tens of thousands, hundreds of thousands within two hours, and has now reached millions. European and other government websites went offline, and Japan's Mitsubishi UFJ Financial Group and Japan's Ministry of Finance suspended some services. The US National Security Agency and the Federal Bureau of Investigation issued a warning that Google, OpenAI, and Amazon participate in vulnerability discovery and protection. The incident highlighted the double-edged sword effect of AI attack and defense and the systemic risks of open source software.
A PHP vulnerability that has been lurking for many years has been uncovered by AI, and the world is urgently patched
According to comprehensive foreign media reports, PHP, a widely used open source programming language, has been revealed to have two key vulnerabilities, collectively known as “PHP2Shell.” The vulnerability could allow a hacker to remotely execute malicious code, potentially exposing sensitive server data. PHP developers released an emergency fix on Wednesday, saying the vulnerability had been lurking for many years, was not discovered until artificial intelligence was used, and “encouraged” all users to update it immediately.
Google, OpenAI, and Amazon all participate in vulnerability discovery, attack detection, or system protection. The US National Security Agency urges organizations using PHP to prepare security updates, warning that the vulnerability may allow attackers to directly access server file systems and databases; if immediate updates are not possible, it is recommended that affected systems be taken offline. The US Federal Bureau of Investigation also warned that malicious actors could use the vulnerability to remotely execute code.
Cloudflare CEO Matthew Prince posted on the X platform on Wednesday night that 10 hours before the vulnerability was publicly disclosed, there had been thousands of use attempts across the network; it jumped to tens of thousands within 45 minutes of the announcement, reaching hundreds of thousands within two hours, and has now reached millions.
Amazon said its MadPot threat detection system detected an attempt at exploiting the vulnerability before it was publicly disclosed, but it is unclear how the attackers obtained the information in advance. Analysts pointed out that the gap between disclosure and large-scale use of the vulnerability is rapidly being compressed, and the traditional “disclose first, then fix” emergency response rhythm is facing challenges.
Global response: Government website offline, financial institutions suspend some services
European and other government websites went offline on Wednesday, with emergency protection systems for global website operators. Japan's Mitsubishi UFJ Financial Group said that due to emergency measures, some internet services were temporarily suspended; Japan's Ministry of Finance temporarily suspended some website content and services while implementing security measures; and Japanese Prime Minister Sanae Takaichi urged website owners to check whether to use PHP and prepare application fixes.
Cloudflare said it has deployed protection against PHP2Shell through the web application firewall. Google says its Wiz cybersecurity department uses AI models to discover and investigate vulnerabilities, and Gemini helps assess bugs, test attack paths, and verify fixes; OpenAI says researchers used its AI model to help discover vulnerabilities and coordinate fixes and prepare protective measures over the past two months.
Market participants believe that in the short term, this incident will strengthen companies' spending expectations in areas such as cloud security, web application firewalls, threat intelligence, and patch management, and the cybersecurity sector is expected to increase its attention. In the medium to long term, AI is changing the efficiency of vulnerability detection, but similar capabilities may also be used by cybercriminals to lower the attack threshold.
For investors, the systemic risks brought about by the widespread use of open source software make enterprise patch management and emergency response capabilities an important indicator of operational resilience; for regulators, critical infrastructure relies on open source components or pushes for stricter disclosure and protection requirements. The incident once again showed that “AI security” is moving from concept to rigid expenditure, and open source governance will also become an important variable in valuation and risk assessment.