The PHP Foundation released emergency patches on Wednesday for “php2shell,” a pair of critical flaws that let an attacker run code on a web server with one crafted request and no login, leaving 22.6 million instances potentially exposed by Palo Alto Networks’ count. AI red-teaming firm Calif, OpenAI, and Google-owned Wiz each found parts of the bug on their own in August using AI models including OpenAI’s GPT-5.6 Sol, even though the flawed code had been part of PHP for 14 years. Exploit attempts started early, with Amazon’s honeypots logging one four days before disclosure. The fixes ship in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, but versions 8.1 and older get no official update, so sites on outdated hosting stay exposed.
