Authorities, clinics and universities have been shutting down their websites since yesterday. The reason is a serious security gap. Who has to act and what role does AI play? What you need to know.
PHP vulnerability: How long does the danger last? Photo: Rob Engelaar/ANP/dpa
The PHP2Shell vulnerability allows attackers to execute malicious code on servers without logging in. This led to the shutdown of government, hospital and university websites worldwide.
The gaps exist in all PHP versions since at least 5.4; they enable the reading of memory contents such as passwords and API keys and were discovered through AI-assisted analysis.
Companies should record PHP installations, update them to version 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and temporarily lock down systems if necessary. The BSI also recommends changing access data and checking systems for attacks.
AI models such as GPT-5.6 Sol and Gemini 4 Argon accelerated the discovery and exploitation of the vulnerability, which experts say increases the cyber threat and makes attacks significantly more cost-effective.
Dusseldorf. A security flaw in the PHP programming language is paralyzing websites worldwide. Since Wednesday, authorities in several federal states, universities and clinics such as the Berlin Charité have taken their websites offline as a precautionary measure. Government websites are also offline in the Netherlands, France, Belgium and Australia.
Two vulnerabilities called “PHP2Shell” allow attackers to execute malicious code on servers without registering. The Federal Office for Information Security (BSI) has declared warning level “3 / Orange”. We answer the most important questions.
What is PHP?
PHP is a programming language that websites use to assemble their content on the server. The software runs on servers invisibly to the user and creates the finished page there, which is then sent to the browser. This is why PHP is also used in third-party programs. Common applications include the WordPress blog software or the private cloud environments Nextcloud and Owncloud.
Cybersecurity
Microsoft boss on the PHP gap: “I haven’t experienced anything comparable in a long time”
How was the leak discovered?
The gaps have been in PHP for a long time and have been known for a long time. But they were not classified as critical. AI has made it possible to chain together the supposedly harmless gaps and design an attack path.
Two teams found the gaps independently. One was the security company Calif, which together with the PHP team carried out a code audit funded by OpenAI (“Patch the Planet”). The other was the team at Google subsidiary Wiz.
How big is the scale?
According to Wiz estimates, PHP runs on around 70 percent of all websites. Experts estimate that 400 to 500 million pages run on WordPress alone. Attackers can remotely execute code without logging in. They can take over a server, access data or misuse it for further attacks.
According to Wiz, the gap can also be used to read RAM, such as passwords, tokens and API keys. The errors are in all PHP versions since at least version 5.4. An attack requires several thousand to ten thousand requests.
Why are so many websites shut down?
The shutdowns are typically a precautionary measure, not an attack. The security update for the vulnerability has been available since Wednesday afternoon around 4 p.m. Anyone who hasn't played it yet is vulnerable. The BSI therefore expressly recommends taking servers offline that do not yet have an update.
Even before the security update, attack tools and screenshots were circulating showing how the vulnerability could be exploited. That's why many operators, including large hosting providers, took their websites offline as a precaution. Since the update was released, the risk has continued to increase. Attackers can analyze the program code of the update to find the exact vulnerability and use this to develop attack programs.
How long does the danger last?
The acute phase lasts until a server has installed the update. Previous major vulnerabilities show how slowly such updates usually spread. One example is the critical security vulnerability “Heartbleed,” which was discovered in spring 2014. According to estimates, around 309,000 public servers were still vulnerable in mid-2014. In January 2017, according to data from the network service Shodan, there were around 180,000, and in July 2019 there were more than 90,000.
In addition, even if the update is installed promptly, it is unclear whether attacks have already taken place. Anyone who was compromised before the update may have a backdoor in their system. Even stolen access data remains usable until someone changes it. Security lawyer Dennis-Kenji Kipker warns of a “long aftermath”.
What do I have to do as a private individual?
For normal Internet users, there is no direct need for action because the gap lies on the servers, not on the PCs, laptops and smartphones. It can still affect private individuals indirectly, for example through outages or data leaks from unprotected services.
If you run your own website or blog, ask your host whether they have installed the PHP update. Anyone who has rented their own server (VPS) is responsible for themselves. Routers, NAS storage and similar devices with a web interface can also use PHP. Here, users should pay attention to updates from the manufacturer. Heise names, among others, QNAP, Synology, Netgear, TP-Link and D-Link. The management interface of such devices should not be accessible from the Internet.
As a general precaution, if a service reports a data leak, customers should change the password there and pay attention to the provider's instructions.
What do companies have to do now?
Experts recommend this sequence to companies:
Inventory: The company records all PHP installations, first those accessible from the Internet. This also includes containers, control panels such as Plesk and cPanel as well as devices with built-in PHP.
Update: The administrators install versions 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or alternatively the packages from their Linux distribution. Then restart PHP and the web server, otherwise the old, vulnerable code will continue to run.
If the update is not possible immediately: The BSI and the EU authority CERT-EU advise temporarily removing the system from the network or sealing it off, for example via VPN or IP sharing. The developers of PHP call their own configuration changes a “temporary crutch”. A firewall reduces the risk, but does not replace the patch.
Check for signs of an attack: Identify new files or programs, unknown users and WordPress admins.
Change access data: Renew passwords, session tokens and API keys if the server was accessible for a longer period of time without the update.
In case of suspicion: isolate the server, back up the logs and only then clean them up.
Official website shut down: “We are experiencing a turning point.” Photo: Thomas Frey/dpa
Why are experts so alarmed?
Two things coincide in the PHP gap: the scope and role of AI. The Google subsidiary Wiz calls the gap possibly one of the most serious in software history. CDU politician Marc Henrichmann, chairman of the secret service control committee, told the Handelsblatt: “We are experiencing a turning point.” This is “one of the most serious security gaps in recent years”.
According to Wiz, AI models have significantly helped with discovery, replication and patch testing. GPT-5.6 Sol (OpenAI) and Gemini 4 Argon (Google) as well as the AI system Wiz Atlas were involved.
Wiz writes that the replication of the attacks was “at the limit of what is practically possible for humans.” A single researcher achieved in a week what would have taken a world-class team months without AI. OpenAI announced that similar discoveries could increase significantly in the coming months.
Why has the cyber threat from AI grown so much?
The use of AI dramatically reduces the cost of attacks. Developing such an attack used to require specialist knowledge and a lot of manual work. This is no longer an obstacle: language models can automatically adapt a security vulnerability to different versions, configurations and hardware conditions - and in the process analyze and correct failures.
The result: the “complexity” of a gap no longer provides protection. Gaps that were considered “hardly exploitable” quickly become “real gateways,” according to CDU security expert Henrichmann.
Does AI also help defend against hacker attacks?
While AI now empowers individuals to carry out complex attacks, it also helps defenders find gaps and check patches. Wiz sees this as an opportunity to routinely search for such gaps.
More: The PHP case reveals a turning point - there is now a threat of two-tier security
