On Wednesday, the National Security Agency issued an advisory recommending critical patches to address a serious PHP vulnerability.
“PHP – short for PHP: Hypertext Preprocessor – works on most major operating systems. It runs directly on web servers and can be added into HTML to create dynamic web pages. Because PHP is so widely used, these security flaws can create an environment ripe for exploitation,” the NSA stated. “We are prioritizing identification of malicious cyber actors that may seek to exploit these vulnerabilities, collectively nicknamed ‘PHP2Shell,’ and recommend organizations take the following precautions.”
The NSA added that in the coming weeks, it will be necessary for IT staff and cybersecurity teams to maintain a heightened level of awareness related to all Internet-facing devices and services that are reliant on PHP.
“It is essential for all to prioritize incorporating vendor patches that may be explicitly tied to the PHP2Shell issues. All users should immediately conduct an inventory, where feasible, of hardware/software services reliant on now-vulnerable PHP versions. Vigilance in applying patches related to those systems is paramount,” the NSA added.
AI Discovery and AI Risks
Researchers discovered the potentially massive security flaw independently using advanced AI tools. The vulnerabilities reportedly affect the core interpreter of the PHP programming language and expose roughly 70% of the Internet, including millions of websites built on WordPress, Drupal, and Joomla.
“The exposure is broad, covering PHP installations serving web requests, including PHP-FPM, Apache, and LiteSpeed. Apache’s mod_php carries the highest stated risk,” explained Ramy Rahman, senior principal solutions engineer at ArmorCode.
Rahman told ClearanceJobs in an email that the roughly 70% figure measures PHP usage, not how many sites are vulnerable, adding that exploitation has been observed through a honeypot network.
“The broad exposure brings comparisons to Heartbleed. It’s too early to say whether the actual impact will compare. What’s different today is that AI can help attackers move faster, giving defenders less time to patch,” Rahman warned.
The Inside Threat
What makes this threat most concerning is that potential attackers do not need prior access, user sessions, or vulnerable third-party application code – the flaw resides inside PHP itself.
“Historically, turning a complex memory-safety bug into a reliable attack required significant expertise and time, repeated testing, and a detailed understanding of the vulnerable software. AI is dramatically reducing that effort, as can be seen by working proof of concepts being deployed within hours of the CVE details being leaked,” added Shane Fry, chief technology officer.
“We can no longer assume that a vulnerability is relatively safe simply because exploitation appears too difficult,” Fry told ClearanceJobs. “Organizations need to harden software at runtime so attackers cannot reliably turn memory corruption into control of a system.”
The most concerning aspect of this vulnerability is that attackers could steal data, alter websites or reach other systems through exposed credentials.
“At scale, a credible worst case is an automated campaign compromising unpatched sites, leading to data theft, fraud and outages,” noted Rahman.
Here is also where AI could help the attackers.
“AI makes it easier to examine large amounts of code and revisit flaws previously considered too difficult to exploit. It also helps attackers reverse-engineer patches, shortening the window between a fix becoming public and an exploit becoming available,” warned Rahman. “Flaws we once thought were impractical to exploit are back on the table. The underlying risks aren’t new, but exploiting them is becoming easier and more accessible. We need to revisit old assumptions and get faster at patching.”
The Patches May Not Be Enough
Given these warnings, the question is whether patching alone will solve PHP vulnerabilities. If an attacker exploited the remote code execution (RCE) flaw before a patch was applied, closing the vulnerability will not remove backdoors, malware, or persistence already established in the environment.
That is why system administrators and security teams now advise actively hunting for unauthorized access tokens, added accounts, or backdoors left behind.
“The release of the PHP patches is an important step, but organizations should not mistake patching for proof that their systems are clean. We are now seeing reports of exploit activity, which makes the window between these vulnerabilities becoming known and systems being patched particularly important. There is a real possibility that vulnerable systems could already have been compromised, including the creation of backdoors,” cautioned Matt Hull, vice president of Cyber Intelligence and Response at NCC Group.
Hull told ClearanceJobs that the potential impact is serious, as any successful exploitation could provide remote shell access and potentially allow an attacker to move laterally into other parts of an organization’s environment.
“Those managing their own PHP systems, particularly internet-facing deployments, therefore need to understand not only whether they have patched, but whether there are signs that an attacker gained access before they did,” Hull continued.
To address the threat, organizations will need to identify all PHP deployments across the environment and apply the official security updates immediately.
“If you have not yet been able to patch an affected internet-facing system, appropriately isolate or disconnect it until it can be remediated,” Hull added. “Once patched, organizations should investigate the period of exposure and monitor closely for indicators of compromise rather than assuming the risk has passed.”
