Internet on the Verge of PHP Failure: Why “The Consequences Will Last for Months, Even Years”

“It’s one of the biggest weaknesses I’ve ever seen in my life”, “Right now “Internet full of people looking for vulnerable machines”. That’s how Sancho Llerena, CEO of cybersecurity company Pandora, described the earthquake that rocked the Internet this week.

Two vulnerabilities have been discovered More than 70% of the world’s web pages are built in the PHP programming language and, by extension, make those responsible for them vulnerable. The PHP Foundation warned of the dangers of introducing solutions to patch computer failures, but chaos has spread anyway.

“In the 10 hours before the public announcement, we saw thousands of attempts to exploit the vulnerability across the network,” said Matthew Prince, CEO of cloud services company CloudFlare ( NET.N ). “Within 45 minutes of the announcement, the number rose to several thousand, Hundreds of thousands in 2 hours and now millions.

The explosive cocktail of this story combines a security breach that can be exploited remotely and without prior access, found in the foundation on which much of today’s Internet is built, and Leaks and AI tools that accelerated results.

What does it consist of?

Two loopholes have been in PHP code for over a decade. The foundation acknowledged that an external audit revealed the first signs in 2024 “We don’t want to deny that: The delay was a structural failure“India is a report published on their website.

It wasn’t until this summer, when three teams became available at the same time How to Exploit Vulnerabilities with AI The Calif firm and the OpenAI team of researchers used the GPT-5.6 Sol model (the same one whose agents were recently involved in the hack). Meanwhile, the Wiz company, owned by Google, has put together its own tools such as the Gemini 4 Argon. Not only did this technology make it easier to quickly discover new gaps, it also developed patches that could be used to cover up the cracks found.

The two vulnerabilities are named PHP2Shell and have Score 9.2 out of 10 on the CVSS scalewhich measures severity in cyber security. Part of this danger is that PHP is a programming language used by up to 70% of Internet websites. For example, all sites designed with WordPress.

When someone visits one of these pages, PHP processes the request, asks for the required data, and prepares the content to be displayed on the screen. To do this, it uses a portion of the memory of the computer where the website is hosted, which frees it up to respond to new requests. Two security flaws identified take advantage of errors that can occur during this process: One when PHP runs out of memory and another when it finishes serving one request and prepares the next one.

The result is that the system leaves the door open for an attacker to enter and execute their own instructions.. Here’s the first key to this disaster, it doesn’t require the hacker to be physically close to the system, it can be done remotely, or prior access to secure networks or systems, it’s huge internet network wide open.

running

Discovery’s release and patches were supposed to be released this Thursday, but a message on a hacker news forum has sped things up. The non-profit foundation that manages PHP had to advance the release of patches by one day.

Sancho Llerena indicated that the regime’s management made the situation worse. Vulnerabilities were kept secret for months until patches were ready to avoid giving away clues, a standard procedure. But a few days ago Details continue to leak.

When confronted with a cybersecurity rumor, “proof is usually requested, but It was so serious that only rumors spread panic“Lerena explained. Analysis of Amazon Web Services revealed that actors were already trying to exploit the flaw last week. The response has been a chain reaction.

Before releasing the patches, Cloudflare CTO Dan Necht confirmed that the company had already implemented a rule to block known PHP2Shell exploit methods and was detecting early attacks targeting the two vulnerabilities. It was able to contain a good portion of the malicious traffic until the patch was ready (Cloudflare handles about 20% of the internet).

at the same time, Companies and governments around the world have rushed to shut down their online services As a precautionary measure until updates with patches are implemented: Institutional websites, digital identification systems, hospital and university online services. Temporary closure pending resolution.

It arrived in patch form on Wednesday afternoon. “When he came out, everyone knew he was weak, they’d never seen anything like it,” says Lerena. Here begins a new phase of chaos, Know where to apply the patch.

“The patching process is very simple, it is done in a minute, the difficulty is that most companies have a computer program and they don’t know where they have applied PHP, we are dedicated to this,” explains the expert.

AI tools are also being applied to cybersecurity to more quickly identify areas that need an update. A problem both small and large.

A new era

In 2024, a security flaw in CrowdStrike blocks half the world, including airports, for a day, making it clear D Weakness An increasingly interconnected world and depend on the same computer system.

Last year, in 2025, numerous Internet server outages reinforced that message: The vastness of the network largely depends on the same four providers.

A year later, everything exploded again with this security breach in PHP. An earthquake that is rapidly felt due to several factors: the severity of the weakness, the poor management of the event and Boost offered by AI tools Both to patch it and to take advantage of it.

AI is used in virtually all attacks today. The automation offered by the most modern models means that Effects that previously depended on many experts and months of work are achieved quickly and with fewer resources.

Earlier this month, major banks in South Korea had their customers’ information stolen by China-based hackers. According to cyber security analysts, This hacker seems to be an amateur which used AI tools to carry out the attack.