Security firm Wiz found two critical flaws in PHP, the language behind about 70 percent of websites according to W3Techs, with help from Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol. The flaws, called PHP2Shell, let attackers take over a web server without logging in, and every PHP version back to 2012 contains at least one of them. On 21 October, the day the fix came out, the Tweede Kamer, MijnOverheid, hospital sites and at least 13 of the 25 Dutch safety regions went offline as a precaution.
Gemini 4 Argon and GPT-5.6 Sol helped Wiz turn the PHP bugs into working attacks
Both flaws are memory bugs in how PHP recovers from errors, for example when a request runs out of memory. Damaged data can survive that error, and a later request can abuse it. Wiz took over standard WordPress, Drupal and Joomla installations this way. It says even a simple “Hello World” page on an affected PHP version can be at risk. A second route reads passwords, tokens and API keys straight from server memory.
Wiz used its own Wiz Atlas agent together with Gemini 4 Argon and GPT-5.6 Sol. It credits the models with help in finding the bugs, adapting the attack to different PHP versions and checking the fix. Its timeline shows two days between the first bug on 19 August and a working WordPress takeover. Wiz also claims one researcher did in a week what used to take a top team months, but publishes no method behind that estimate.
Separately, security firm Calif found one of the flaws with GPT-5.6 Sol as part of OpenAI’s Patch the Planet programme. OpenAI says that, as far as it knows, AI found these bugs before attackers did.
Dutch hospitals, safety regions and the Tweede Kamer went offline until they could patch
PHP announced on 20 October that the fix would ship the next day at 16:00 Dutch time. Details leaked online hours before that. CERT-EU, the EU’s cybersecurity team, advised organisations to map every PHP application. It advised cutting public ones off from the internet for the time being if they could not be patched at once.
Many Dutch organisations did just that on Wednesday. AG Connect counted the Tweede Kamer, MijnOverheid, the Schiphol app, the Port of Rotterdam and several hospital websites among them. At least 13 of the 25 safety regions, which run fire services and crisis management, were offline too. The NCSC, the national cybersecurity centre, took its own site down as a precaution. Most central government sites stayed up because they do not run on PHP.
NOS reported that MijnOverheid returned just after 18:00 and the DigiD website around 20:30. Government sites in Belgium, Finland, France and Germany were also briefly offline.
watchTowr saw attacks on both PHP flaws as the patches came out
The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older no longer get official updates. For 7.4, 8.0 and 8.1 the PHP team only published minimal source patches, meant for people who build PHP themselves. PHP’s security advisory also lists temporary settings for servers that cannot update yet. It warns that these reduce exposure but do not make a server safe.
Security firm watchTowr reported attack attempts on both flaws on Wednesday afternoon, as the patches came out, without confirmed break-ins. Later that day the NCSC and the American cyber agency CISA said they had not seen active abuse, NOS reported. Because details were public before the fix, an update closes the hole but does not prove that nobody got in first.
Is my WordPress site at risk from PHP2Shell?
Yes, as long as the server under it runs an unpatched PHP version, whatever theme or plugins you use. Wiz attacked the standard WordPress image, and the flaw sits in PHP itself, so a WordPress update does not fix it. On managed hosting, the hosting company updates PHP. In some control panels you pick the PHP version yourself. The same applies to Drupal, Joomla, Laravel apps and any home-built PHP tool.
Ask your web partner for the PHP version number, not a reassurance
For most organisations, PHP is invisible. It sits under the website, the intranet, a booking form or a customer portal that someone else built and hosts. Wednesday showed what that means. When a patch has to go in within hours and you cannot confirm the update, switching the site off is the only safe move left. Do these four things today:
- Ask your hosting company or web partner which PHP version runs each site and web application, and get the exact number. It should be 8.5.12, 8.4.27, 8.3.36, 8.2.35 or later.
- Ask whether PHP was restarted after the update and whether the logs were checked for signs of a break-in, such as unknown files, new scheduled tasks or new admin accounts.
- Set an upgrade date for anything on PHP 8.1 or older. Those versions get no official fixes, now or next time.
- Agree in writing how fast your partner patches critical flaws and who may decide to take a site offline.
The AI part of this story is why it will happen again. These holes sat in PHP for more than a decade. What changed is how quickly AI models help find bugs like these and turn them into attacks. OpenAI expects similar findings to “increase sharply in the coming months”, and attackers can use comparable models. For organisations, the work itself is familiar: know what software you run, who patches it and how fast. It now has to go right more often.
For more information, visit the official announcement of PHP2Shell on the Wiz blog.
