PHP Security Flaw Exposed as AI Helps Attackers Exploit Vulnerabilities Within Minutes

Cybersecurity researcher Ryan Austin, who has studied PHP security for 20 years, says he has discovered a serious flaw in the programming language—one he described as the most significant vulnerability he has ever found.

Speaking to the Today programme, Austin said the discovery began with a hunch that the vulnerability could not have been exploited without artificial intelligence (AI).

Serious PHP vulnerability linked to AI-assisted attacks

Austin described PHP as one of the first web languages to power the early internet. He said the language remains embedded in many systems that underpin the web, including areas where people may not expect to find it.

“Basically, the core of how the internet works in many different ways is in a lot of places you wouldn’t expect,” Austin said. He compared PHP to old infrastructure in a house that continues to keep everything running, even when people do not think about it.

However, Austin said the incident was not necessarily bad news because organisations would now be expected to update and patch PHP immediately if they had not already done so.

Amazon detects PHP2Shell exploitation attempt

Amazon announced on Wednesday that it had identified a “PHP2Shell exploitation attempt” on 17 October.

CJ Moses, Amazon’s head of security, said an anonymous internet address had targeted a weakness in the company’s decoy, or “honeypot”, system.

According to Moses, the use of anonymous IP addresses suggested that the activity was carried out by a threat actor.

The PHP Foundation had planned to publish its findings later this month alongside a complete fix, commonly known as a patch. However, details of the flaw were leaked on social media on Tuesday.

In further attacks against Amazon on 21 October, the actual payload and anonymisation infrastructure varied. Moses said this suggested that multiple attackers were involved.

The attacks took place after the breach but before the embargo on the PHP security warning had been lifted.

AI could accelerate cyberattacks

Moses said the use of AI meant that more attackers could act within hours—or even minutes—after the technical details of a vulnerability were disclosed.

Anna Maria Arabia, chief executive of the Australian AI Strategy Council, told the BBC that the PHP incident demonstrated how quickly AI was changing the cybersecurity landscape.

“It used to take months to uncover vulnerabilities, now it takes days,” she said.

Arabia warned that similar threats could become more common as AI technology continues to advance rapidly. In other words, she said, the incident was “not a setback”.

PHP flaw may affect much of the internet

The PHP flaws are believed to have gone undetected for at least 10 years.

Cybersecurity firm Wiz estimates that around 70% of the internet has been affected, although the BBC has not independently verified that figure.

Several BBC programme websites, including those for Doctor Who and The Traitors, are currently inaccessible. The BBC has asked for comment and has not confirmed whether the outages are linked to PHP.

The Office for Budget Responsibility said it was following guidance to take its website offline “in light of significant security issues affecting PHP”.

The websites of the City of Edinburgh and Oxford City Council were also taken offline on Wednesday, but both are now accessible.