AI uncovers critical flaws in software powering much of the web

The vulnerabilities, collectively dubbed PHP2Shell by Wiz, could allow attackers to take control of affected servers or steal sensitive information without logging in.

According to Wiz’s findings, researchers demonstrated attacks against WordPress, Drupal and Joomla installations. The weaknesses lie in PHP’s core engine, meaning websites can be exposed even when their own application code is secure.

Wiz said AI helped researchers turn complex, longstanding flaws into working exploits and adapt them to different applications.

“With frontier AI models and the right tools, a single researcher completed in a week what previously would have taken a world-class team months of work,” the company said.

The PHP project released security updates on October 21, covering versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Its official advisory urged users to update immediately and warned that temporary mitigations do not provide complete protection.

The PHP Foundation said the release was brought forward by one day after vulnerability identifiers circulated online before the planned disclosure. Both vulnerabilities carry a severity score of 9.2 out of 10.

The official reports do not confirm widespread website shutdowns. The 70% figure describes PHP’s estimated reach across websites, rather than the proportion confirmed compromised or taken offline.

Earlier, QazinformNews Agency reported that the United States had ordered federal civilian agencies to remove DeepSeek AI products from their information technology systems and barred them from purchasing the Chinese company’s technology.