Government websites across Europe were taken offline on Wednesday as cybersecurity experts raised concerns about serious security flaws in PHP, a programming language used by millions of websites. The move came as the US National Security Agency (NSA) warned organisations to install security updates immediately or take their servers offline.
The security scare highlights how artificial intelligence (AI) is helping hackers find and exploit software weaknesses much faster than before. Vulnerabilities that once took weeks or months to discover and exploit can now be used within hours, cybersecurity experts told CNBC.
Matt Suiche, a researcher at cybersecurity startup Tolmo, said the level of urgency around these threats was something new. He said AI tools are now helping both cybersecurity teams and attackers, making it easier for hackers to find weaknesses and act quickly, as cited by CNBC.
Deep Dive
What can attackers do with the PHP2Shell vulnerabilities?
Why did some governments take their websites offline after the PHP flaws were found?
What should organisations do to protect PHP servers from PHP2Shell?
PHP is a programming language created in the 1990s. It helps websites process requests and run functions on their servers. According to W3Techs, PHP is used by just under 70% of websites whose server-side programming language is known.
AI tools help find PHP2Shell vulnerabilities
In mid-August, researchers at AI company Calif and Google's cybersecurity firm Wiz identified vulnerabilities affecting PHP installations that handle web requests. The researchers used AI tools to help find the weaknesses, according to CNBC.
{{/usCountry}}In mid-August, researchers at AI company Calif and Google's cybersecurity firm Wiz identified vulnerabilities affecting PHP installations that handle web requests. The researchers used AI tools to help find the weaknesses, according to CNBC.
{{/usCountry}}Also read: US Treasury yields fall as investors track Middle East tensions, await US jobless claims data
Calif's researchers used OpenAI's GPT-5.6 Sol model. The Wiz team used its Wiz Atlas security AI agent, Google's Gemini 4 Argon and GPT-5.6 Sol. These tools helped researchers examine the software and explore different ways the security flaws could be exploited.
The security flaws allow hackers to remotely run code on affected PHP servers without logging in or proving their identity. This could allow attackers to steal data, access sensitive information and potentially gain control over parts of a vulnerable system, according to CNBC.
PHP security patches released early
The PHP Foundation had planned to release fixes for the vulnerabilities on Thursday. However, information about the flaws began spreading through online forums before the planned release. The situation became more urgent after Calif accidentally published a video showing a proof-of-concept exploit on Tuesday.
Calif's video demonstrated a chain of steps that could be used to exploit the vulnerabilities. Although the video was later removed, the information had already raised concerns about the risk of other people developing working attacks.
The foundation fast-tracked the security updates and released them at 10 a.m. Eastern Time on Wednesday, a day earlier than planned. The US National Security Agency issued its warning shortly before the patches were released, according to CNBC.
By then, code claiming to exploit PHP2Shell on any server had already been published on GitHub, an online platform for sharing and storing software code. GitHub is owned by Microsoft. The appearance of this code added to concerns that attackers could quickly try to use the vulnerabilities against exposed servers.
Also read: World’s largest sovereign wealth fund loses $30 billion in Q3 as bond returns fall
Elizabeth Barron, executive director of The PHP Foundation, told CNBC on Wednesday afternoon that the organisation was closely monitoring the situation. She said there was no evidence of working exploits at that point, describing the generated examples that had appeared as incomplete, misguided and non-working, according to CNBC.
AI-powered hackers develop working exploit quickly
Matt Suiche said his team at Tolmo was able to develop a working exploit in under 24 hours. He said AI made it relatively quick to reproduce the vulnerability in a local environment. Before today's more powerful AI models, the same work could have taken his team several weeks.
Amazon Threat Intelligence said on Wednesday that it had identified an attempt to exploit PHP2Shell on Saturday. The activity was detected through its MadPot telemetry network, which uses digital decoys to identify and study suspicious connections and potential cyberattacks.
PHP Foundation admits security failure
Mihail Kirov, a product security engineer at Tolmo who previously worked at Quarkslab, said he was part of a team that discovered a vulnerability with the same root cause as PHP2Shell two years ago. Kirov said The PHP Foundation had been alerted to the earlier flaw, but a fix was not released at the time, according to CNBC.
In a blog post published on Wednesday, the foundation described the delay in addressing the earlier issue as a “structural failure.” It said the problem was caused by decisions made by its security team and a lack of resources, according to the foundation's blog post.
The latest research showed how quickly AI tools can help security researchers explore possible weaknesses. Calif's researchers identified two vulnerabilities, both rated 9.2 out of 10 for severity. Kirov said large language models allow researchers to examine many different angles much faster.
Older government websites face greater cyber risks
Cybersecurity experts warned that fixing the flaws does not automatically reveal whether a server was attacked before the updates were installed. Organisations may have to investigate their systems separately to find out whether attackers accessed sensitive information.
Neatsun Ziv, chief executive of cybersecurity company Ox Security, said organisations could struggle to identify suspicious requests if they had not already installed an application security platform before an attack. Without such monitoring, some attempts to exploit a vulnerability may go unnoticed, according to CNBC.
Suiche said a company might realise it had been hacked only after its valuable data appeared for sale on the dark web. His comments highlight the difficulty of identifying a breach when organisations lack strong monitoring and security systems.
Suiche said PHP is a legacy server language and some organisations using it may not have sophisticated security measures in place. He pointed out that city governments and other public agencies often use PHP and may have websites that have not been updated for 10 years, according to CNBC.
Suiche warned that older government websites can contain or provide access to critical data. This makes the security flaws especially concerning because a successful attack could put sensitive public-sector information at risk.
Anthropic's Mythos AI model raises cyberattack concerns
Cybersecurity experts say the threat has grown as more powerful AI models have become available. The technology can help attackers analyse software, identify vulnerabilities and develop ways to exploit them much faster than traditional methods.
Anthropic, the company behind Claude, released its powerful Mythos model to a limited group of companies and government agencies in April 2026. The aim was to allow selected organisations to test its cybersecurity capabilities and ensure that appropriate security measures were in place before a wider release, according to CNBC.
Neatsun Ziv said hackers previously needed weeks to discover a new vulnerability and exploit it across the internet. That timeline later fell to days and, since the arrival of the Mythos era in April 2026, can be as short as hours, he told CNBC.
The PHP2Shell vulnerabilities have raised concerns because PHP is widely used, the flaws can allow remote code execution without authentication, and AI can speed up the process of turning a weakness into a working attack. The incident underlines the need for organisations to install security updates quickly, monitor their servers and check whether their systems were accessed before the fixes were applied.