[AI Hacking] “Shut Down Servers for Emergency Checks”: Businesses Hit by ‘PHP Shock,’ With More AI-Discovered Security Flaws on the Horizon

Server intrusion flaws found in PHP, used by 70% of websites
Exploitation attempts before disclosure, followed by signs of attack preparations linked to North Korea
Emergency responses by businesses and institutions bring mounting disruption and recovery burdens

The discovery of critical security vulnerabilities in PHP (Hypertext Preprocessor), a programming language used by seven out of 10 websites worldwide, has put global internet security on alert. The flaws allow outside attackers to execute malicious code on servers without authentication. Attempts to exploit them were detected even before their disclosure, followed by signs that hackers suspected of links to North Korea were preparing attacks. Some organizations have even suspended services to prevent attacks, turning the security threat into business disruption and a recovery burden. The cybersecurity industry expects more critical vulnerabilities like those in PHP to emerge in the near term as artificial intelligence (AI) tools uncover hidden flaws in existing software.

PHP Vulnerabilities Allow Server Intrusion Without Authentication

According to the PHP development team on the 25th (all dates hereafter are local time), two security vulnerabilities were identified in PHP, a programming language widely used by websites worldwide, that allow outside attackers to execute malicious code on servers without authentication. Collectively called “PHP2Shell,” the vulnerabilities were assigned the identifiers “CVE-2026-109618” and “CVE-2026-109619.” Each received a severity score of 9.2 out of 10 under the Common Vulnerability Scoring System (CVSS 4.0), placing them in the highest risk category, “critical.” Attackers can send crafted web requests to execute arbitrary commands on a server, potentially leading to information leaks, data tampering and service outages. In particular, attacks were found to be possible even before website application code runs in environments where PHP operates as an Apache web server module.

Signs of attempts to exploit the vulnerabilities were detected as early as four days before their disclosure. In a post on Amazon’s security blog on the 21st, Amazon Chief Information Security Officer (CISO) CJ Moses said an analysis of records from its MadPot threat detection system had identified attempted attacks targeting PHP2Shell on the 17th. MadPot gathers information on intrusion techniques and attacker activity through decoy servers set up to lure attackers. Additional attacks were detected hours before the official announcement on the day of disclosure, and new exploit code emerged within hours after disclosure, targeting the detection network.

The flaws targeted by attackers lay in the way PHP cleans up memory after encountering an error while processing a request. The first vulnerability occurs when an operation, such as processing a file upload, stops after reaching the memory limit. If the operation halts before internal data is fully constructed, the subsequent cleanup process can treat incomplete data as valid values, potentially causing memory corruption. The second flaw leaves internal references to memory in place even after memory used for a previous request has been freed. If the same worker process references that information again while handling the next request, an attacker may be able to interfere with the execution flow. Both flaws occur within PHP as it processes web requests, meaning multiple websites built on it can be affected.

Table 1. Key Details of the PHP2Shell Vulnerabilities

PHP Flaws Pose Risks Even When Website Code Is Secure

Tests assessing whether actual attacks were possible also exposed vulnerabilities in several website creation and management systems. Researchers at cloud security company Wiz successfully executed code remotely without authentication on WordPress, Drupal and Joomla deployments running the latest releases available at the time of testing. The researchers explained that even websites with no security issues in their own code can be exposed to attacks if they use a vulnerable PHP version. Even a basic webpage designed to display only a short greeting faces the same risk. They also identified a way to steal information without remote code execution. In a separate experiment, the researchers read the memory of a PHP process to extract passwords, authentication tokens and API keys used to connect to external services.

AI played a decisive role in establishing that flaws long present in PHP could be exploited for actual intrusions. Wiz researchers used AI tools to analyze complex memory-handling processes and link multiple flaws to develop an attack method that executes code on a server. AI was also used to adapt exploit code to different server environments and identify errors. According to the researchers, the vulnerable code had existed for more than 10 years, and exploiting it required complex analysis and repeated testing. Since signs of attacks were found before disclosure, the possibility remains that hackers had already identified the security flaws and used them for covert intrusions.

Signs North Korean Hacking Group Lazarus Is Preparing Attacks Exploiting PHP Vulnerabilities

Signs of attack preparations detected after the vulnerabilities were disclosed also raised the possibility of North Korean links. In a report released on the 23rd, Singapore-based cybersecurity company CYFIRMA said Korean-speaking hackers had discussed attacks using PHP2Shell in private chat rooms on the anonymous I2P network. They were found to have prioritized government agencies and banks and classified targets by country and industry. Government and financial institutions in the United States, Japan and the European Union (EU), among others, were included, while logistics, ports, airports and manufacturing were also discussed as targets. AI was used in the preparations as well. The hackers collected publicly available exploit code, used AI to prioritize it for use and then tested whether it worked in a separate test environment.

CYFIRMA focused on a possible North Korean connection because it judged the language used in the conversations, the target selection and the attack techniques to resemble the past activities of Lazarus, a North Korea-backed hacking group. Work instructions and target lists were exchanged in Korean in the private chat rooms, and plans to prioritize government and financial institutions were also identified. Conversations obtained on the 24th included a claim that 216 servers with inadequate security had been selected, along with discussions about adjusting connection volumes to avoid detection while checking targets for vulnerabilities. CYFIRMA assessed this as consistent with Lazarus’s pattern of pursuing both government secrets and financial theft. The technique of infiltrating web servers, installing malware for remote control and using compromised servers as bases for subsequent attacks was also cited as evidence supporting a possible connection.

Table 2. Signs of Preparations for Attacks Exploiting PHP2Shell and Possible North Korean Links

Businesses Face Growing Burdens, From Security Checks to Server Recovery

As signs of attack preparations emerged, businesses found themselves having to accept operational disruptions caused by security measures. PHP is used across public-facing websites, partner portals and administrator interfaces, making even identifying what needs inspection difficult. Loris Degioanni, chief technology officer (CTO) of cloud security company Sysdig, pointed to websites missing from asset inventories and predicted that some servers would remain exposed to attacks for weeks or months. Blocking access to systems whose inspections are delayed inevitably disrupts core operations as well. Nick McKenzie, CISO of cybersecurity company Bugcrowd, said businesses were being forced to weigh the risk of serious cyberattacks against business losses from service interruptions.

The impact of service suspensions was also visible in website availability data. According to website monitoring company UptimeRobot, outage alerts across its monitoring network peaked at 37,000 per minute on the 21st, 11 times the normal level. Bottlenecks in applying updates contributed to the concentration of connectivity problems for hours after security updates were released. A surge in simultaneous download demand caused errors on some distribution servers. In some cases, releases suited to particular server environments were delayed, prompting administrators to build directly from source code. Recovery took time, with outage alerts remaining about 30% above normal until the following morning.

Businesses that actually suffered intrusions face the additional tasks of removing malware and investigating the extent of the damage. Even after PHP’s flaws are fixed, remote-control programs planted by attackers or stolen accounts pose a significant risk of remaining available as routes back into the systems. Recovery requires digital forensics to trace access logs and intrusion paths and determine whether other systems were affected. If the findings require rebuilding servers and validating backups, the cost of specialist personnel and the recovery period will inevitably increase. In particular, prolonged outages in systems used to exchange order and delivery information with business partners could also delay partners’ shipments and payment processing.

Cloudflare: “A Crisis Every Week for Years”

The inspection and recovery burdens exposed by the PHP incident are expected to recur whenever software vulnerabilities are disclosed. As AI uncovers hidden flaws in existing software one after another, observers expect large-scale security responses like the PHP response to become a recurring event. Cloudflare CEO Matthew Prince noted that several serious flaws had already been identified and predicted a situation that would feel like facing a crisis every week for the next several years. The expectation is that expanding AI-based code analysis will bring a succession of long-buried flaws to light. OpenAI also said on the 21st that several critical vulnerabilities beyond PHP had been discovered and were being fixed, and anticipated a sharp increase in similar discoveries over the coming months. Patrick Garrity, a researcher at threat intelligence company VulnCheck, likewise predicted more frequent emergency responses involving internet-exposed systems.

Before businesses can take security measures, the relevant software development teams must first validate and fix the flaws, but staffing for that work is already limited. OpenAI noted that many open-source development teams rely on small groups of people to handle both routine development and reviews of security reports. An influx of AI-discovered flaws would add a wave of validation work to their existing duties. Cybersecurity company Trail of Bits said it had found hundreds of bugs across 19 open-source projects in just the first week of a joint AI-assisted review last June. The submitted findings included false positives and duplicate reports, requiring experts to determine whether they were genuine flaws and whether they could be exploited. Even validated flaws require patches to be written and functionality tested. For software shared across multiple products, fixes for older versions must also be produced and preparations made to deploy them across individual services.

Adding to businesses’ burdens is the shrinking time available to prepare for attacks as vulnerability discoveries increase. AI has reached the point where it can continuously analyze vast amounts of code and produce code that exploits discovered flaws in actual attacks within hours. Shane Fry, CTO of RunSafe Security, said the time needed to discover vulnerabilities and the time attackers need to weaponize them are fundamentally changing. Attack preparations can thus proceed while organizations are still verifying that patches work and applying them across systems in sequence. As emergency updates become more frequent, teams on the ground are expected to face growing pressure to complete security measures while adequately assessing their impact on normal operations.