Behind the scenes of the race to prevent 'chaos on the Internet'

"Someone on Twitter can take the bugs, use AI to attack and post how to exploit the vulnerabilities," Duong Ngoc Thai, CEO of Calif Research, told WSJ. "Things could get chaotic."

Calif Research, an American security startup with many Vietnamese members, was the first to discover one of two PHP2Shell vulnerabilities. It can be exploited in many ways, some in just a few seconds, by hackers who can use it to run unauthorized software on any unpatched web server.

Volker Dusch, an engineer at the non-profit PHP project management organization PHP Foundation, rates PHP2Shell as the most serious security issue PHP has faced in more than a decade. He drew comparisons to Heartbleed, a similar widespread vulnerability that forced the world to race to secure hundreds of thousands of servers more than a decade ago. According to Safe Security, Heartbleed was discovered in April 2014 in OpenSSL, allowing attackers to send special requests to read data in server memory, potentially exposing passwords, encryption keys, login information and other sensitive data without authentication.

Calif Research researcher Ryan Austin discovered one of the two PHP2Shell vulnerabilities using OpenAI's GPT-5.6 Sol model during an inspection of the PHP source code one day in late July. OpenAI sponsored the inspection, which is part of the company behind ChatGPT's effort to help open source projects troubleshoot software errors with AI.

According to Mr. Thai, this type of vulnerability has been lurking in the PHP source code for many years, but is too difficult to exploit and has largely been forgotten. But AI has found a way.

Using OpenAI's latest model, Austin can control code running in computer memory with just a few dozen requests sent to the PHP server. On small systems, attacks take only a few seconds, and hours if the system is complex.

On August 11, Mr. Thai called Dusch: "This is a serious problem. I had a moment wondering: God, what do we do now?".

“How do I communicate this,” Dusch replied. "Just stay calm, let the adrenaline flow, and get to work on the repairs."

Soon after, an informal working group was formed between researchers and software engineers from PHP and Calif Research. They cooperated with a number of software distributors and security companies to find a way to patch PHP2Shell, preventing it from being exploited.

Sharing with CNBC, OpenAI said researchers discovered two serious vulnerabilities in PHP using the GPT-5.6 Sol model two months ago, through a coalition of software maintainers, cybersecurity researchers and security vendors, coordinating patches and preparing protection measures before making them public.

At the same time, Google's Wiz cybersecurity research team also had similar findings. On the blog, the company said it found two PHP security vulnerabilities through the Gemini 4 Argon model. "Gemini 4 Argon makes important contributions to vulnerability discovery, exploit development, attack detection, and patch validation," Google said.

"PHP2Shell is the most serious security vulnerability ever found by AI, and is probably too complex to detect without AI," Ami Luttwak, co-founder of Wiz, emphasized.

Returning to the Calif Research team, Mr. Thai said that the joint research team kept the existence of PHP2Shell an absolute secret, and at the same time accelerated the process of finding a fix. They fear hackers will also use AI to detect and exploit vulnerabilities before the patch is completed. The process was considered "extremely large-scale", having to repair nearly 200 files. Developers wrote more than 10,000 lines of code during this process.

Finally, the patch release date is set, which is October 22.

However, the inevitable happened: the vulnerability information was suddenly published on Hacker News on October 21. At this time, Dusch and the team decided to release the patch early, and called on administrators to update immediately.

"It's a fine balance between providing information to the defender and not allowing attackers too much time to develop tools to exploit the vulnerability," Dusch added.

Some signs indicate that the vulnerability is being exploited in practice. "As expected, we saw the latest PHP vulnerability being exploited," researcher Jake Knott of cybersecurity company WatchTowr told CNet. "No one has succeeded yet, but that probably won't last long."

Degree of influence

Speaking to TechTarget, security research firm Palo Alto Networks said it has identified more than 22.6 million servers potentially vulnerable to PHP2Shell.

On Twitter, Peter Steinberger, the "father" of OpenClaw, assessed that the vulnerability would still "cause chaos" this week, as businesses and website administrators using PHP rush to implement the necessary patch.

In fact, more and more government organizations and businesses are proactively "closing" websites or platforms to prevent incidents. Besides France, the Netherlands, Denmark and Australia, most recently, Japanese Prime Minister Sanae Takaichi warned that businesses in this country should consider temporarily suspending service provision if necessary to minimize risks. "Check your public websites to see if they use PHP and prepare to apply the released patch, ASAP," Ms. Takaichi wrote on Twitter.

According to CNBC, the race to release patches by PHP and cybersecurity groups has helped prevent a possible "Internet disaster". This page highlights the importance of AI in the context of increasingly easy to detect vulnerabilities, which can cause risks across many industries and internationally. On one side, AI plays a role in helping security researchers detect and fix weaknesses, while on the other side, it tries to use AI to exploit security loopholes.

Forrester analyst Madelein van der Hout said that what makes PHP2Shell so serious is where it exists. PHP is the foundation of about 70% of websites and applications, so just testing and providing instant patches is not enough.

"Speed ​​is important, but patching is only part of the solution," Ms Hout said. "Security teams need to determine where PHP is running, prioritize where vulnerable, apply official patches promptly, and investigate signs of compromise. Patches only fix vulnerabilities, not removing access that attackers may have established."

Justin Timothy, a threat intelligence consultant with security intelligence and research group GuidePoint (GRIT), emphasized that hunting for early signs is important, but platform administrators need to be on the lookout for future risks. "There are currently no signs that this vulnerability has been compromised on a large scale. However, a 'clean' result does not mean that the possibility of compromise has been ruled out," Timothy told TechTarget.

Meanwhile, Vietnam's National Cyber ​​Security Association said that PHP is currently widely used, but the risk of affecting each system depends on many factors, such as the PHP version in use or the website deployment model. "The important thing is that the patch is ready, service providers have begun to respond, organizations have enough information to act. The priority now is systematic review, patching in the right order and continuous monitoring, instead of worrying too much," the Association representative assessed.