Tech • AI • Robotics • Game
Matthew Prince on PHP2Shell, Duo on Arrival, 100 Really Difficult Phone Calls, Norwegian Gold Scheme
7/10TL;DR
A newly disclosed pair of PHP vulnerabilities has triggered a surge of attacks across the internet, prompting urgent calls for server operators to patch immediately while browser and operating system updates address a separate certificate security failure that can affect consumers.
KEY POINTS
Critical PHP flaws expose much of the web
Two vulnerabilities in PHP, the web programming language that underpins roughly 70% of websites, allow remote code execution, meaning attackers can take over servers by sending crafted requests. That can expose files, capture usernames and passwords, and turn compromised machines into tools for botnets or other criminal activity. Platforms built on PHP, including WordPress, are among the ecosystems most exposed.
Discovery led to a two-month quiet response
OpenAI first alerted Cloudflare about the issue about two months before public disclosure, after combining model-assisted work with findings from security researchers. A second flaw was later reported by Wiz, now part of Google. The response involved the PHP Foundation, Automattic, major infrastructure providers and the U.S. government, with organizations trying to prepare defenses before details became public.
Attacks escalated from thousands to millions per minute
Once the patch was released, attackers quickly inferred how to exploit the flaws. Cloudflare said observed attack traffic jumped from thousands of attempts across its network before release to millions of attacks per minute afterward. The company said it had already deployed mitigations for all customers, including free users, but described those protections as only a temporary layer until administrators install updates.
Patch now or take servers offline
The message to businesses running PHP services is direct: update to the latest version immediately. The patch is free and should take only minutes in many environments, while managed platforms may apply it automatically. NSA guidance cited in the discussion went further, advising that if patching is not possible, it is safer to take exposed servers offline than leave them running unprotected.
Most consumers are not directly exposed to the PHP bug
The PHP emergency mainly affects companies, developers and web administrators rather than end users’ phones or laptops. Consumers do not need a special response for PHP itself unless they operate websites or servers. The greater consumer risk this week came from a different issue involving internet trust certificates.
Certificate blunder makes updates essential for users
A separate security failure involved root certificate infrastructure that should have been protected with 328-bit-class secrets but in some cases reportedly used trivially weak values such as 4 and 136. If abused by someone positioned in network traffic, such certificates could help impersonate services like banks or major web platforms. Browser and operating system vendors have moved to distrust the affected certificates, but users must update their devices and browsers for that protection to take effect.
AI is accelerating defense as well as raising pressure
The current PHP exploitation wave does not require advanced AI once the flaw is known; simple scripts can scan the internet for vulnerable servers. The bigger shift is that AI helps researchers find serious bugs faster and helps attackers understand compromised environments more quickly after gaining access. That dynamic is expected to produce a steady stream of alarming disclosures over the next two years, even as defenders argue the long-term effect will be a safer internet.
Attackers are increasingly chasing compute and tokens
Recent pressure on infrastructure providers reflects another trend: cybercriminals want access to AI compute, inference capacity and stolen tokens. Services connected to identity, cloud access or model usage have become especially attractive targets because they can open paths to more valuable systems. Security teams now see cyber defense as an arms race in speed, automation and access to large-scale infrastructure.
The internet’s business model may have to change
One longer-term concern is that automated agent traffic could dwarf human traffic, potentially by 1,000 times within five years if current trends hold. That would strain networks and websites as AI agents repeatedly query vast numbers of online resources. A possible answer raised in the discussion is some form of micropayment or negotiated access model, where agents pay tiny sums to retrieve data instead of consuming web resources for free at massive scale.
CONCLUSION
The immediate priority is clear: organizations running PHP should patch now, and consumers should install pending browser and operating system updates. The broader picture is that AI is exposing hidden weaknesses faster than before, forcing the internet to harden rapidly under pressure.
Ask a question