Researchers at Google's Wiz division and the AI firm Calif identified two critical vulnerabilities in PHP, a decades-old programming language that powers approximately 70% of websites with known server-side programming languages. The flaws, discovered in August using advanced AI models including OpenAI's GPT-5.6 Sol and Google's Gemini 4 Argon, allow unauthenticated hackers to remotely execute code on any affected PHP server, potentially enabling data theft and unauthorized access to sensitive information.

The vulnerabilities have existed across every version of PHP dating back roughly 20 years. The PHP Foundation had planned to release patches on Thursday, but word of the flaws spread online and Calif accidentally posted a proof-of-concept video on Tuesday demonstrating the exploit. In response, the foundation released patches 24 hours early at 10 a.m. ET on Wednesday, just before the U.S. National Security Agency issued a warning urging millions of organizations to either implement patches immediately or take their servers offline.

The incident triggered what cybersecurity experts have described as "Black October." By Tuesday, the warnings had spread globally, prompting governments and major companies to scramble to contain the fallout. Government websites in the United Kingdom and Europe went offline Wednesday as a precaution, as did some sites in the Wikipedia family, the Internet Archive, DeviantArt, and 4Chan. The outages were preventative measures rather than the result of actual breaches, but they illustrated the scale of the threat.

The speed with which the vulnerabilities were weaponized underscores how artificial intelligence is reshaping the cybersecurity landscape. Matt Suiche, a researcher at cybersecurity startup Tolmo, said that previously, exploits of this type would have taken his team "multiple weeks" to develop, but with AI, his team produced a working exploit in less than a day. Amazon Threat Intelligence reported identifying a PHP2Shell exploit attempt on its monitoring network on Saturday, days before patches were released.

However, as of Thursday evening, researchers and spokespeople from nine major cybersecurity firms—including CrowdStrike, ESET, Google Threat Intelligence Group, Palo Alto Networks, and Sophos—reported they had not seen successful attacks exploiting the vulnerabilities in the wild. Don Smith, vice president of threat research at Sophos, said that "across all our telemetry, and we are looking hard, we have only seen a couple of real exploitation attempts." Experts attributed the limited exploitation in part to the technical difficulty of the vulnerabilities and the limited helpfulness of some widely available AI models at exploiting them.

The Elizabeth Barron, executive director of The PHP Foundation, told CNBC on Wednesday that the organization is "diligently monitoring the situation" and noted there is currently no "evidence of any working exploits, only incomplete, misguided, and non-working generated ones." However, that assessment conflicts with reports from Suiche and Tolmo. The foundation also acknowledged in a blog post that a similar root cause vulnerability had been reported two years earlier but was never fixed, describing the delay as a "structural failure, caused by both the security team's decision process and its lack of resources."

Cybersecurity leaders are warning that this incident represents only the beginning of AI-driven threats. Jason Clinton, deputy chief information security officer at Anthropic, wrote on X (formerly Twitter) on Thursday that the cybersecurity landscape is likely to get "a lot worse" before it improves, and urged security leaders to seek board approval for basic security fundamentals. Chris Krebs, former director of the U.S. Cybersecurity and Infrastructure Security Agency, noted that the current crisis poses particular risks for small and medium-sized businesses that may lack access to advanced AI tools to harden their systems. He called the week "a significant" moment in cybersecurity, noting that 3% of all critical vulnerabilities ever discovered have been found in the last month.