AI-found PHP flaw forces governments to take websites offline
OpenAI says one of its models found the 'php2shell' bugs, which allow remote code execution on any PHP server; the Netherlands, France and others pulled services to patch.
The PHP Foundation disclosed two critical vulnerabilities in the PHP scripting language, which runs a large share of the world's websites, and released a security update, The National reported. US cyber agency CISA said the flaws, dubbed php2shell, allow unauthenticated remote code execution on PHP installations that serve web requests.
The Netherlands, Finland, France and Australia temporarily took some government services offline to apply the patch, and the NSA advised organisations that could not update quickly to disconnect affected systems.
“This is about as broad as a critical vulnerability gets.”
Moshe Siman Tov Bustan, lead researcher, Ox Security
OpenAI said one of its models found the vulnerability, calling it one of the most impactful in recent memory. Researchers advised treating unpatched public PHP systems as exposed.
Reported from
- The National21 Oct
This story summarises the reporting above in Shasha Post’s own words. Spotted an error? Tell us: corrections are made in the story and noted at its foot.