This is a first-person article based on an interview with Yonaton Keller, the 46-year-old product manager at Zafran Security in Tel Aviv, edited for length and clarity.
At 6:30 AM on Wednesday, I woke up to multiple messages alerting me that two vulnerabilities had been disclosed in the PHP programming language, around 4:45 AM.
I immediately realized this was a very serious matter.
The website runs different versions of PHP, which is estimated to be used by about 70% of websites worldwide. PHP vulnerabilities are not new, but this particular vulnerability requires almost no authentication from attackers.
This is a very tricky situation. A year and a half ago, few would have responded with such urgency. But this may be among the first major incidents of its kind in the age of artificial intelligence, where the attackers’ methods have disrupted our usual response rhythm.
AI has improved detection and response speeds, but it also means that anyone with limited technical skills could exploit these vulnerabilities within minutes.
My team is very concerned and must act quickly.
I was in Israel, so it was 6:30 a.m. here while it was still midnight in the U.S. This time difference benefited our team, as we had time to figure out exactly what had happened before our clients woke up.
PHP is an open-source computer programming language used to create websites and web applications. Its widespread use meant we immediately recognized that all customers—including large enterprises and companies of all types—could be affected.
Exploiting vulnerabilities or critical flaws in infrastructure, such as the two issues discovered in PHP, is actually quite straightforward, especially when using AI agents. What we first realized is that even completely inexperienced attackers can exploit these vulnerabilities to take websites offline.
The PHP Foundation stated that details of the vulnerabilities will be disclosed around 5:00 PM Israel Time, along with patch releases for newer PHP versions. However, some details were informally disclosed on an online forum; the post was removed minutes later, but screenshots quickly spread across unofficial forums on the internet.
Therefore, my team and I put aside all other tasks and spent the entire Wednesday gathering informal information to see if we could reduce the risk of exploitation before the official fix was released.
How to determine if you are affected
The first step people can take is to examine their website and web applications to determine where PHP is being used. You can also assume that, unless your website consists only of very basic HTML pages, it likely uses PHP in some way.
The second step is to check what alerts were provided by online vulnerability scanning tools. Tenable, Qualys, and Rapid7 are the three major vendors that typically release detection rules and actually identify vulnerabilities. In this incident, due to the widespread panic caused by these vulnerabilities globally, they responded very quickly. This is also a way to understand the specific vulnerabilities in your internet-facing assets.
After completing these steps, immediately upgrade your website to the current version of PHP. The upgrade is straightforward and free. However, some technical steps may still be required after the fix, so you might need a technician to implement them. If you do not update your PHP version, the impact on your business and website could be extremely severe.
Some people are also taking their websites completely offline; I think this may be the right choice if you have evidence that you're being specifically targeted. However, 70% of the global internet cannot and should not be taken offline simply because of some vulnerabilities. If you have evidence of potential exploitation, this is an emergency measure—but it shouldn't become a step taken by everyone.
This isn't just about attackers disrupting your website or web application; more seriously, they could take control of your server, steal sensitive files, move laterally within your network, and then carry out malicious actions such as deploying ransomware or anything else they intend to do.
The situation has improved, but my cybersecurity team remains very concerned.
Since Wednesday, the situation has calmed down slightly, but we are still very, very concerned. Patching 70% of websites globally cannot be done in just a minute or two.
Within hours of the PHP Foundation releasing its patch, numerous exploitation attempts appeared online. Attackers are becoming faster and faster. I believe that in this AI era, many attackers can launch attacks within minutes—you no longer have the same amount of time you once had.
The old traditional process—first defining the attack surface, then creating a remediation plan, and only then seeking out the people responsible for executing the fixes—no longer works.
For a long time, institutions have invested heavily in so-called "post-breach" scenarios. I believe that cybersecurity in the AI era will shift more toward "preemptive defense," allowing protective measures to be built in advance and ready to respond to attacks in similar situations.