Server intrusion flaws found in PHP, used by 70% of websites
Exploitation attempts before disclosure, plus signs of North Korea-linked attack preparations
Emergency responses by businesses and institutions bring growing disruption and recovery burdens

The discovery of critical security vulnerabilities in PHP (Hypertext Preprocessor), a programming language used by seven out of 10 websites worldwide, has put global internet security on high alert. The flaws allow outside attackers to execute malicious code on servers without authentication. Attempts to exploit them were detected even before disclosure, followed by signs of attack preparations by hackers suspected of links to North Korea. With some organizations suspending services to prevent attacks, the security threat has translated into business disruption and recovery burdens. The security industry expects major vulnerabilities like those in PHP to continue emerging for some time as artificial intelligence (AI) tools uncover hidden flaws in existing software.

PHP Vulnerabilities Allow Unauthenticated Server Intrusion

According to the PHP development team on the 25th (all dates hereafter are local time), two security vulnerabilities were identified in PHP, a programming language widely used on websites worldwide, that allow outside attackers to execute malicious code on servers without authentication. Collectively known as “PHP2Shell,” the vulnerabilities were assigned the identifiers “CVE-2026-109618” and “CVE-2026-109619.” Each received a severity score of 9.2 out of 10 under the Common Vulnerability Scoring System (CVSS 4.0), placing them in the highest risk category, “critical.” Attackers can send crafted web requests to execute arbitrary commands on a server, creating risks of information leaks, data tampering and service outages. In particular, attacks were found to be possible even before a website’s program code executes in environments running PHP as an Apache web server module.

Signs of attempts to exploit the vulnerabilities were detected four days before their disclosure. In a post on the company’s security blog on the 21st, Amazon Chief Information Security Officer (CISO) CJ Moses said an analysis of records from its “MadPot” threat detection system had identified attack attempts targeting PHP2Shell on the 17th. MadPot collects intrusion techniques and activity through decoy servers set up to lure attackers. On the day the vulnerabilities were disclosed, additional attacks were detected hours before the official announcement. Within hours after disclosure, new attack code appeared and targeted the detection network.

The flaws targeted by attackers lay in the process of cleaning up memory when PHP encounters an error while handling a request. The first vulnerability occurs when an operation, such as processing a file upload, is interrupted after reaching its memory usage limit. If the operation stops before internal data is fully constructed, the subsequent cleanup process can treat incomplete data as valid values, potentially causing memory corruption. The second flaw leaves internal information pointing to memory even after the memory used for a previous request has been freed. If the same worker process references that information again while handling the next request, an attacker may be able to interfere with the execution flow. Both flaws occur inside PHP as it processes web requests, meaning multiple websites built on it can be affected.

Table 1. Key Details of the PHP2Shell Vulnerabilities

PHP Flaws Pose Risks Even When Website Code Is Secure

Tests to verify whether the vulnerabilities could be exploited in practice also exposed weaknesses in several website creation and management systems. Researchers at cloud security company Wiz succeeded in executing code remotely without authentication in the latest available deployments of WordPress, Drupal and Joomla at the time of testing. The researchers explained that using a vulnerable PHP version can expose a website to attack even if its own code has no security issues. Even a basic webpage designed to display only a brief greeting faces the same risk. They also identified a way to steal information without remote code execution. In a separate experiment, the researchers read memory from a PHP process and extracted passwords, authentication tokens and API keys used to access external services.

AI played a decisive role in establishing that flaws that had long remained in PHP could be exploited for actual intrusions. Wiz researchers used AI tools to analyze complex memory-handling processes and develop an attack method that chained multiple flaws together to execute code on a server. AI was also used to adapt attack code to different server environments and identify errors. According to the researchers, the vulnerable code had existed for more than 10 years, and exploiting it required complex analysis and repeated testing. Since traces of attacks were found before disclosure, the possibility remains that hackers had identified the security weaknesses first and used them for covert intrusions.

Signs North Korean Hacking Group Lazarus Was Preparing Attacks Using PHP Vulnerabilities

Signs of attack preparations detected after the vulnerabilities were disclosed also raised the possibility of North Korean links. In a report published on the 23rd, Singapore-based cybersecurity company CYFIRMA said Korean-speaking hackers had discussed attacks using PHP2Shell in a private chatroom on the anonymous I2P network. They were found to have designated government agencies and banks as priority targets and categorized targets by country and industry. Government and financial institutions in the United States, Japan and the European Union (EU), among others, were included, while logistics, ports, airports and manufacturing were also discussed as targets. AI was used in the attack preparations as well. The hackers collected publicly available attack code, used AI to rank it by priority for use, and then tested whether it worked in a separate test environment.

CYFIRMA focused on possible North Korean links because it judged the language used in the conversations, target selection and attack techniques to resemble the past activities of Lazarus, a North Korea-backed hacking group. Work instructions and target lists were exchanged in Korean in the private chatroom, and plans to prioritize government and financial institutions were also identified. Conversations obtained on the 24th included a claim that 216 poorly secured servers had been shortlisted, along with discussions about adjusting connection volumes to avoid detection while checking targets for vulnerabilities. CYFIRMA assessed that this matched Lazarus’s pattern of pursuing both government secrets and financial theft. The technique of infiltrating web servers, installing remote-control malware and using compromised servers as bases for subsequent attacks was also cited as evidence supporting a possible link.

Table 2. Signs of Attack Preparations Exploiting PHP2Shell and Possible North Korean Links

Businesses Face Growing Burdens, From Security Checks to Server Recovery

As signs of attack preparations emerged, businesses found themselves having to accept operational disruptions caused by security measures. PHP is used across public-facing websites, partner portals and administrative interfaces, making even the identification of systems requiring inspection difficult. Loris Degioanni, chief technology officer (CTO) at cloud security company Sysdig, pointed to websites missing from management inventories and predicted that some servers would remain exposed to attacks for weeks or months. Blocking access to systems whose inspections are delayed inevitably disrupts core operations as well. Nick McKenzie, CISO at security company Bugcrowd, explained that businesses must weigh the risk of a serious cyberattack against business losses from service interruptions.

The impact of service outages was also evident in website availability data. According to website monitoring company UptimeRobot, outage alerts across its monitoring network peaked at 37,000 per minute on the 21st, 11 times the usual level. Bottlenecks during the update process also contributed to the concentration of connectivity problems for hours after security updates were released. A surge in demand for file downloads caused errors on some distribution servers. In some cases, administrators built the source code themselves because releases suited to their server environments were delayed. Recovery took time, with outage alerts remaining about 30% above normal until the following morning.

Companies that suffered actual intrusions face the additional tasks of removing malware and investigating the extent of the damage. Even after PHP’s flaws are fixed, remote-control programs planted by attackers or compromised accounts pose a significant risk of remaining as routes for reentry. Recovery requires digital forensic work to trace access records and intrusion paths and determine whether other systems were affected. If the findings necessitate rebuilding servers and verifying backups, the cost of specialist personnel and the recovery period will inevitably increase. In particular, prolonged outages in systems used to exchange order and delivery information with business partners could also delay partners’ shipping and settlement operations.

Cloudflare: “A Crisis Every Week for Years”

The inspection and recovery burdens exposed by the PHP incident are expected to recur whenever software vulnerabilities are disclosed. With AI uncovering hidden flaws in existing software one after another, observers expect large-scale security responses like the one involving PHP to become a recurring event. Cloudflare CEO Matthew Prince noted that several serious flaws had already been identified and predicted that the coming years would feel like facing a crisis every week. The expectation is that expanded AI-based code analysis will expose a succession of long-buried weaknesses. OpenAI also said on the 21st that it had discovered several other critical vulnerabilities beyond PHP that were being fixed, and expected similar discoveries to surge over the coming months. Patrick Garrity, a researcher at threat intelligence company VulnCheck, likewise predicted more frequent emergency responses involving internet-exposed systems.

Before businesses can take security measures, the relevant software development teams must first verify and fix the flaws, but staffing for that work is already limited. OpenAI noted that many open-source development teams rely on small numbers of people to handle both routine development and the review of security reports. An influx of AI-discovered flaws adds verification work to their existing workload. Security company Trail of Bits said that it had found hundreds of bugs across 19 open-source projects in just the first week of a joint AI-assisted review last June. The submitted findings included false positives and duplicate reports, requiring experts to determine whether they were genuine flaws and whether they could be exploited. Even verified flaws must go through patch development and functional testing. For software shared across multiple products, teams must also prepare fixes for older versions and arrange deployment for each service.

Another factor adding to businesses’ burden is that the time available to prepare for attacks is shrinking even as vulnerability discoveries increase. AI has reached the point where it can continuously analyze vast amounts of code and, within hours, produce code that exploits the weaknesses it finds. Shane Fry, CTO at RunSafe Security, said the time needed to discover vulnerabilities and the time attackers need to weaponize them are fundamentally changing. Attack preparations can proceed even while patches are being tested and rolled out across systems in sequence. As emergency updates become more frequent, operational teams are expected to face greater pressure to complete security measures while adequately assessing their impact on normal operations.