PHP2Shell Bugs Force Global Sites Offline

On August 11 and 24, AI‑driven researchers uncovered two PHP2Shell flaws that let attackers run code without a login. The PHP Foundation admitted a structural failure, blaming a small core team and lack of resources. Governments worldwide took sites offline, from the Netherlands’ digital ID service to Australia’s cyber.gov.au. The NSA warned U.S. organizations to shut PHP sites if updates were not immediate. Amazon’s MadPot system detected exploit attempts before public disclosure, though it was unclear how attackers learned the flaws. Google’s Wiz and OpenAI’s Gemini AI helped identify and test the vulnerabilities, illustrating AI’s dual role. Cloudflare deployed web‑application‑firewall rules to block malicious requests while sites applied patches. No functional exploits were confirmed, but the PHP Foundation urged immediate updates to all affected versions. The incident shows how AI can accelerate vulnerability discovery and the need for coordinated global defense. As the world watches, the PHP Foundation vows to rebuild trust and strengthen its development process.