Government websites across Europe were taken offline on Wednesday as cybersecurity experts raised concerns about serious security flaws in PHP, a programming language used by millions of websites. The move came as the US National Security Agency (NSA) warned organisations to install security updates immediately or take their servers offline.
The US National Security Agency issued its warning shortly before the patches were released, according to CNBC. Calif’s video demonstrated a chain of steps that could be used to exploit the vulnerabilities. the information had already raised concerns about the risk of other people developing working attacks Although the video was later removed.
The foundation fast-tracked the security updates and released them at 10 a.m. Anthropic, the company behind Claude, released its powerful Mythos model to a limited group of companies and government agencies in April 2026. That timeline later fell to days and, since the arrival of the Mythos era in April 2026, can be as short as hours, he told CNBC.
Because pHP is widely used, the flaws can allow remote code execution without authentication, and AI can speed up the process of turning a weakness into a working attack, the PHP2Shell vulnerabilities have raised concerns.
The aim was to allow selected organisations to test its cybersecurity capabilities and ensure that appropriate security measures were in place before a wider release, according to CNBC. Neatsun Ziv said hackers previously needed weeks to discover a new vulnerability and exploit it across the internet.
However, information about the flaws began spreading through online forums before the planned release. The incident underlines the need for organisations to install security updates quickly, monitor their servers and check whether their systems were accessed before the fixes were applied. The PHP Foundation had planned to release fixes for the vulnerabilities on Thursday. The situation became more urgent after Calif accidentally published a video showing a proof-of-concept exploit on Tuesday. Eastern Time on Wednesday, a day earlier than planned.
PHP is used by just under 70% of websites whose server-side programming language is known, according to W3Techs. Calif’s researchers used OpenAI’s GPT-5.6 Sol model. The Wiz team used its Wiz Atlas security AI agent, Google’s Gemini 4 Argon and GPT-5.6 Sol. Matt Suiche said his team at Tolmo was able to develop a working exploit in under 24 hours. Calif’s researchers identified two vulnerabilities, both rated 9.2 out of 10 for severity.
Kirov said The PHP Foundation had been alerted to the earlier flaw, but a fix was not released at the time, according to CNBC. The security scare highlights how artificial intelligence (AI) is helping hackers find and exploit software weaknesses much faster than before. PHP is a programming language created in the 1990s. It helps websites process requests and run functions on their servers. In mid-August, researchers at AI company Calif and Google’s cybersecurity firm Wiz identified vulnerabilities affecting PHP installations that handle web requests. These tools helped researchers examine the software and explore different ways the security flaws could be exploited. The security flaws allow hackers to remotely run code on affected PHP servers without logging in or proving their identity. By then, code claiming to exploit PHP2Shell on any server had already been published on GitHub, an online platform for sharing and storing software code. GitHub is owned by Microsoft. The appearance of this code added to concerns that attackers could quickly try to use the vulnerabilities against exposed servers. The activity was detected through its MadPot telemetry network, which uses digital decoys to identify and study suspicious connections and potential cyberattacks. The latest research showed how quickly AI tools can help security researchers explore possible weaknesses. Organisations may have to investigate their systems separately to find out whether attackers accessed sensitive information. Cybersecurity experts say the threat has grown as more powerful AI models have become available. The technology can help attackers analyse software, identify vulnerabilities and develop ways to exploit them much faster than traditional methods.
Vulnerabilities that once took weeks or months to discover and exploit can now be used within hours, cybersecurity experts told CNBC. Matt Suiche, a researcher at cybersecurity startup Tolmo, said the level of urgency around these threats was something new. He said AI tools are now helping both cybersecurity teams and attackers, making it easier for hackers to find weaknesses and act quickly, as cited by CNBC. The researchers used AI tools to help find the weaknesses, according to CNBC. This could allow attackers to steal data, access sensitive information and potentially gain control over parts of a vulnerable system, according to CNBC. She said there was no evidence of working exploits at that point, describing the generated examples that had appeared as incomplete, misguided and non-working, according to CNBC. He said AI made it relatively quick to reproduce the vulnerability in a local environment. Mihail Kirov, a product security engineer at Tolmo who previously worked at Quarkslab, said he was part of a team that discovered a vulnerability with the same root cause as PHP2Shell two years ago. It said the problem was caused by decisions made by its security team and a lack of resources, according to the foundation’s blog post. Kirov said large language models allow researchers to examine many different angles much faster. Neatsun Ziv, chief executive of cybersecurity company Ox Security , said organisations could struggle to identify suspicious requests if they had not already installed an application security platform before an attack. Without such monitoring, some attempts to exploit a vulnerability may go unnoticed, according to CNBC.
Cybersecurity experts warned that fixing the flaws does not automatically reveal whether a server was attacked before the updates were installed. Elizabeth Barron, executive director of The PHP Foundation, told CNBC on Wednesday afternoon that the organisation was closely monitoring the situation. Before today’s more powerful AI models, the same work could have taken his team several weeks. Amazon Threat Intelligence said on Wednesday that it had identified an attempt to exploit PHP2Shell on Saturday. In a blog post published on Wednesday, the foundation described the delay in addressing the earlier issue as a “structural failure.
His comments highlight the difficulty of identifying a breach when organisations lack strong monitoring and security systems. Suiche warned that older government websites can contain or provide access to critical data. He pointed out that city governments and other public agencies often use PHP and may have websites that have not been updated for 10 years, according to CNBC.
Because a successful attack could put sensitive public-sector information at risk, this makes the security flaws especially concerning.
Suiche said a company might realise it had been hacked only after its valuable data appeared for sale on the dark web. Suiche said PHP is a legacy server language and some organisations using it may not have sophisticated security measures in place.
