Critical PHP2Shell vulnerability puts widely used platform at risk

A critical vulnerability dubbed PHP2Shell was found in PHP and is linked to the way it manages memory. The hosts said PHP runs on roughly 70% of websites. The flaw was discovered during an August source-code audit, with researcher Ryan Austin assisted by OpenAI’s GPT-5.6 Sol model. The bug had remained in the code for years, despite a problem area having been flagged decades earlier. Exploitation can take seconds on smaller systems and require only a few dozen requests; on more complex systems, it can take hours.

The hosts called it PHP’s most severe vulnerability in more than a decade and compared its potential reach to Heartbleed. Researchers, engineers, software distributors and companies including Google Wiz and OpenAI worked together on fixes and kept the flaw secret to avoid giving attackers a head start. According to the hosts, the patching effort involved close to 200 files and more than 10,000 lines of code. A patch release was set for October 22; after information leaked on Tuesday, the team decided to release it early. The hosts said the main patch had now appeared, though earlier in the discussion they were unsure whether it was out.

The hosts warned that attackers could study the patch and use the changes to find vulnerable servers, while small organizations and operators of older sites might not update promptly. They said government websites in Finland, the Netherlands and France had been temporarily taken offline, and that Japan’s prime minister urged operators to check PHP websites and prepare to install the fix. OpenAI also released a Codex skill to help check whether a website is affected. The hosts expressed concern about possible exposure of user data but did not claim that widespread exploitation had already occurred.