- Government agencies across Europe, Asia and North America took websites offline on Oct. 21 after OpenAI's GPT 5.6-Sol AI model uncovered critical flaws in the PHP programming language, affecting up to 70% of the internet.
- The two vulnerabilities, dubbed PHP2Shell, allow attackers to remotely run commands on servers without authorization, with security firm Wiz calling them among the most severe in software history.
- The flaws were leaked before the intended release date due to Chainguard unilaterally breaking the embargo, prompting coordinated warnings from the NSA, FBI and global cybersecurity agencies advising organizations to take systems offline if patching was not immediate.
- Exploitation attempts escalated rapidly, from thousands before public announcement to millions within two hours, according to Cloudflare, while Amazon Web Services confirmed broad exploitation in the wild.
- The PHP Foundation has issued patches, warning that AI tools now find bugs faster than ever for both defenders and attackers – signaling that this incident is "just the beginning of a wider wave of attacks."
Government agencies across Europe, Asia and North America urgently took down websites offline on Wednesday, Oct. 21, after artificial intelligence (AI) tools uncovered critical flaws in the PHP programming language that could affect up to 70% of the internet.
The vulnerabilities were discovered by OpenAI's GPT 5.6-Sol AI model and reported to the nonprofit PHP Foundation. They represent a fundamental breach in the foundation of web infrastructure that has existed for decades, but only now become exploitable through advanced AI capabilities.
The PHP Foundation confirmed Wednesday that the flaws were leaked before the intended release date through a combination of mistaken and intentional breaches. Cybersecurity company Chainguard "unilaterally broke the embargo" in an action that "disregarded weeks of work by many parties toward a coordinated disclosure."
Cybersecurity officials across the globe meanwhile issued a coordinated response to the breach. The U.S. National Security Agency (NSA), the Federal Bureau of Investigation's Cyber Division and the Cybersecurity and Infrastructure Security Agency joined counterparts from the United Kingdom, Australia, Canada, Germany, Japan and other nations in issuing rare public warnings advising organizations to consider taking systems offline if immediate patching was not possible.
"These vulnerabilities often provide a direct path to the server's file system or database," the NSA wrote in a public statement. "If an immediate update is not feasible, it is recommended that organizations take the system offline until it can be fully mitigated." Thomas Caspers, vice president of the German Federal Office for Information Security, warned that "short-term, large-scale exploitation" was likely before the fix was released.
The two vulnerabilities, dubbed PHP2Shell by researchers, exploit the ability to access parts of computer memory without proper authorization – allowing attackers to remotely run commands on servers running outdated PHP code without requiring a password or legitimate account access. Security firm Wiz, which reported the second vulnerability on Aug. 24, said the findings "rank among the most severe vulnerabilities discovered in PHP, and arguably in software history." The firm noted that while the underlying flaws had existed for decades, proving they were exploitable required a chain of steps "at the edge of what human researchers could practically achieve."
How frontier AI models both saved and endangered the internet
Cloudflare CEO Matthew Prince reported that exploitation attempts escalated rapidly once the vulnerability became public. "In the 10 hours before it was publicly announced, across the network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within two hours, and millions now," Prince wrote.
Amazon Web Services confirmed the flaw is now "being broadly exploited in the wild" and revealed that suspected hackers attempted to capitalize on the vulnerability days before it was publicly announced. The timing of this crisis is historically significant.
As data loss and information technology security have become serious issues over the past two decades, measures such as encryption, monitoring and password protection have gained increasing importance. Given this, the PHP Foundation warned that "tools now find bugs faster than ever, for defenders and attackers alike, and the number of reports will keep growing."
OpenAI noted in its blog post on the incident that "to our knowledge, frontier AI found these vulnerabilities before attackers did, opening a defender's window for maintainers and security providers to prepare fixes and protections ahead of disclosure." However, the company acknowledged that while AI can help uncover issues, it can also aid attackers. Indeed, BrightU.AI's Enoch engine points out that AI enables globalists and Big Tech to automate cyberattacks that can dismantle human autonomy and resistance with surgical precision.
Alp Toker, a cybersecurity expert and director at NetBlocks, warned that this incident represents "just the beginning of a wider wave of attacks." Speaking about the vulnerability, Toker explained: "Anybody on the web can essentially access your web server if you're running the PHP software." He added that AI agents could "reproduce the attack much more easily" and cautioned that "these systems are going to continue to get compromised – month after month, year after year."
The PHP Foundation has issued patches for both vulnerabilities and urged anyone administering a website to update their code immediately. As the dust settles on this unprecedented global response, the incident serves as a stark reminder that the digital infrastructure citizens and governments rely upon daily rests on foundations that require constant vigilance and rapid response to emerging threats, with AI now fundamentally altering the balance between those who defend and those who exploit these systems.
Watch Matt Bracken and the Health Ranger Mike Adams explaining how AI could transform cyber warfare in this clip.
This video is from the Brighteon Highlights channel on Brighteon.com.
Sources include:
Please contact us for more information.