NederlandsPHP flaw was known for two years and is now being actively exploited
A review by the PHP Foundation shows that one of the PHP2Shell flaws had been known since 2024. Attackers are now actively exploiting it, so updating matters more than ever.
On 21 October, urgent updates were released for PHP, the programming language behind a large part of the web, after researchers used AI to find two serious flaws, together called PHP2Shell (we wrote about it at the time). A review by the PHP Foundation now shows that one of those flaws had been known since 2024. And attackers are now actively exploiting it.
Known for two years
A PHP developer saw the first signs of the flaw in 2024, while fixing another problem. Nobody found a concrete way to exploit it at the time, and the repair stalled for months. The security team had several solutions, but each had a drawback: one would have broken existing software, another made it easier to knock servers offline, and a third would have forced thousands of PHP extensions to be changed. The team only decided when everyone agreed. The Foundation itself calls the delay a structural failure, caused by this way of deciding and by too few people. The team will now decide by majority vote.
Only this summer did researchers at Calif and OpenAI find a way to exploit the old flaw. According to OpenAI, its model GPT-5.6 Sol helped to turn a flaw that humans had not solved for two years into working attacks within two weeks.
Now being actively exploited
On 26 October, the US cyber agency CISA added both flaws to its list of flaws that are being actively exploited. The security company Dream Security reported that attackers combined PHP2Shell with Fragnesia, a flaw in the core of Linux. This gave them full control of 25 servers in the United States, Japan, Taiwan and South Korea, and they then attacked three servers in an environment connected to the US government.
According to counts by the research company Censys, about 30 million PHP installations on the internet were still running a vulnerable version at the end of October. Anyone with a PHP website is best advised to check whether it already runs PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12, or to ask the hosting provider whether that has been done.
What does this mean for the road to the singularity?
AI finds flaws faster than humans, but choosing the right fix for an old design decision remains work for experienced developers, and they are scarce. The Foundation has therefore hired extra people. It asks companies, hosting providers and governments that run on PHP to support this work. In this way, software that almost everyone uses becomes safer, step by step.
What is the technological singularity? Read the explanation →
