AI-powered hackers exploit PHP flaw as Europe takes government websites offline; NSA warns of cyberattack risks

On Wednesday, government websites across Europe experienced outages as cybersecurity experts warned of significant security flaws in PHP, a widely-used programming language. The United States National Security Agency (NSA) also cautioned organizations to implement security updates immediately or disable their servers. The incident underscores the accelerating pace at which AI aids hackers in identifying and exploiting software weaknesses.

AI tools can now discover and exploit vulnerabilities within hours, a dramatic improvement from the weeks or months it previously took. Matt Suiche, a researcher at cybersecurity startup Tolmo, emphasized the unprecedented urgency surrounding these threats, stating that AI tools assist both security teams and attackers, making it easier for hackers to rapidly exploit weaknesses.

PHP, developed in the 1990s, is used by nearly 70% of websites whose server-side programming language is known, according to W3Techs. In mid-August, researchers at AI company Calif and Google's cybersecurity firm Wiz discovered vulnerabilities affecting PHP installations that handle web requests. They employed AI tools such as OpenAI's GPT-5.6 Sol model, Wiz Atlas security AI agent, Google's Gemini 4 Argon, and GPT-5.6 Sol to explore the software and identify potential exploitation methods.

These vulnerabilities enable hackers to remotely execute code on affected PHP servers without authentication, potentially allowing them to steal data, access sensitive information, or gain control over vulnerable systems. The PHP Foundation planned to release fixes on Thursday, but researchers at Calif accidentally published a proof-of-concept exploit video on Tuesday, raising concerns about the risk of other individuals developing working attacks.

The PHP Foundation swiftly released security updates on Wednesday, a day earlier than initially planned. However, by then, a GitHub repository had already been compromised with code purported to exploit PHP2Shell on any server. This development further heightened concerns regarding attackers' rapid attempts to leverage the vulnerabilities against exposed servers.

Although the PHP Foundation's executive director, Elizabeth Barron, stated that there was no evidence of working exploits at the time, Matt Suiche from Tolmo's team was able to develop a functional exploit within 24 hours. AI models like GPT-5.6 Sol significantly expedited the process, which would have previously taken his team several weeks.

Amazon Threat Intelligence reported an attempted exploitation of PHP2Shell on Saturday, detected through its MadPot telemetry network. Tolmo's Mihail Kirov, who previously discovered a vulnerability with the same root cause two years ago, noted that The PHP Foundation had been informed about the earlier flaw but did not receive a timely fix. The foundation described the delay as a "structural failure," attributing it to decisions made by its security team and insufficient resources.

Despite the release of security updates, cybersecurity experts warned that verifying whether a server was compromised prior to the updates may require separate investigations. Organizations might need to employ application security platforms to monitor suspicious requests, as relying solely on post-update checks could lead to undetected attacks.

Notably, Suiche highlighted that PHP's legacy status and the potential lack of robust security measures in some organizations could make identifying breaches challenging, as attackers may exploit vulnerabilities before they are discovered or go unnoticed due to inadequate monitoring systems.