Do you run sites on PHP? Have you updated them this week? If not, read below.
This week a bug in PHP made universities and government agencies switch their websites off.
Two critical vulnerabilities in PHP itself (nicknamed PHP2Shell) let an attacker take over a web server without logging in. Researchers from Calif, Wiz and OpenAI found them with the help of AI. In the Netherlands and Finland, public agencies pulled their sites offline as a precaution, before the patch was out.
The same month, Microsoft fixed more than 1,400 vulnerabilities in one Patch Tuesday, a record, and credits AI-driven bug hunting for the volume.
AI works both ways. It finds bugs faster than ever, and it helps attackers turn them into working exploits faster too. But it also helps defend.
I support two side projects with PHP sites. I gave Claude Code a link to a post about the bug. It found every site exposed and proposed switching off the risky PHP setting at once. Before changing anything, it checked the logs for signs of an attack and found none. Then it watched Docker Hub until the patched PHP image was out. I approved and ran the commands it prepared.
I think in the coming months we will see many more incidents like this. How fast can your team patch a critical bug today: hours or weeks?
First published on LinkedIn.
Discuss on LinkedIn