AI-Found PHP2Shell Flaws Force Sites Offline; Open-Source Maintainers Face Surge in Bugs

6.0 · 1d ago · WORLD · AI

The Facts

  • Two critical vulnerabilities, nicknamed PHP2Shell, were disclosed in PHP, the open-source language that runs roughly 70% of websites, and organizations rushed to patch; some took sites offline until fixed. ✓2 · TechCrunch, Al Jazeera
  • The PHP2Shell flaws were discovered by independent cybersecurity experts using AI and had been in PHP code for more than a decade. Al Jazeera only
  • Wiz CTO Tomer Schwartz of Exposure Management & AppSec, Wiz being Google-owned, took part in the fix effort alongside OpenAI, research group Calif, and the PHP team. TechCrunch only
  • Google said the latest Chrome update fixed more than 1,000 security bugs, more than the last two dozen updates combined. Al Jazeera only
  • Mozilla found more than 400 Firefox security vulnerabilities in April, up from a previous record of 76 the month before. Al Jazeera only
Dive deeper · 3 more factsShow less
  • Apache Software Foundation volunteer Jarek Potiuk said the project has about 10 times more issues than usual because it is using AI to find them, and that humans must still review results to weed out false positives. Al Jazeera only
  • Anthropic's Project Glasswing offered $100m in credits for its Claude Mythos model to search critical software for flaws; more than 23,000 vulnerabilities were found across more than 1,000 open-source projects in one month. Al Jazeera only
  • The PHP Foundation, a nonprofit launched in 2021 to coordinate PHP development, operates on a small budget. Al Jazeera only

Context

Two critical flaws in PHP, dubbed PHP2Shell, prompted emergency patching worldwide, with some government and corporate sites briefly offline. Researchers say AI is accelerating discovery of such vulnerabilities.

Maintainers of open-source software, often volunteers or small foundations, say they lack resources to triage and fix the growing volume of AI-found bugs. Al Jazeera cites figures from Google, Mozilla, Apache and Anthropic showing sharp increases in discovered flaws.

How the Agent Panel Scored This

Independent AI personas each scored importance 1–10; the story's score is a trimmed mean (highest and lowest votes dropped). Vote spread: 1.

6 News Editor Two critical PHP vulnerabilities prompted emergency patching and some sites went offline, a concrete event with broad reach, but the story is largely a trend piece about AI-found bugs and maintainer strain rather than a single immediate breaking event.
6 Critical Reader Two critical PHP vulnerabilities forced some sites offline and triggered emergency patching, a concrete measurable event with broad reach, but the story is largely trend commentary with vague 'some sites' impact and no verified scale of harm.
6 Policy Expert Two critical PHP vulnerabilities prompted emergency patching and some sites went offline, a concrete widespread security event, but the story is largely trend coverage on AI-driven bug discovery rather than a single major breaking incident with sweeping immediate impact.
6 Business Analyst Two critical PHP vulnerabilities affecting a language running roughly 70% of websites prompted emergency patching and some sites going offline, a concrete and widely impactful security event, though it is more a cybersecurity incident than a market-moving economic action.
6 Informed Citizen Two critical PHP flaws prompted emergency patching and some sites went offline, a concrete event affecting many websites, but the impact was largely resolved by patching and the story is more a trend piece about AI-found bug volume.
6 Science & Tech Analyst Two critical PHP vulnerabilities affecting a language running about 70% of websites, forcing emergency patches and some site outages, plus a broader concrete surge in AI-found bugs across Chrome, Firefox, and Apache, makes this a moderately significant, newsworthy story rather than breaking global crisis.
5 Global Affairs Analyst Two critical PHP vulnerabilities forced emergency patching and some sites offline, a notable cybersecurity event, but the story is mostly a trend piece on AI-driven bug discovery with limited concrete geopolitical impact.

Sources (2)

← All stories