A flaw sat inside most of the internet for 10 years until AI showed hackers how to use it. The website holding your data may have had an open door for a decade, and AI just found the handle. Attackers need no username and no password, just one well crafted request, and an unpatched server is theirs. The flaw is called "PHP2Shell". Researchers reportedly used an advanced OpenAI model to work out how to exploit it, after it had stumped experts for years. Here is what it means in plain English, and what to do before someone uses it on you. PHP is the engine quietly running WordPress sites, online shops, government portals, payment pages, and plenty of crypto project websites. Around 7 in 10 websites where the server language is known run on it. The two flaws live inside PHP itself, not in the website built on top of it. An attacker sends the right request and can run their own commands on the server. From there they can steal customer data, install malware, knock the site offline, or use that server as a doorway into everything else on the network. The AI part is the real story, and this is my analysis. If AI can turn old bugs into working attacks, the time between discovery and damage just got much shorter. Authorities are treating it that way. The FBI is reportedly urging sites that cannot patch to go offline, and one national cyber authority gave every government agency 7 days to fix it and report back. If you just browse the web, visiting a PHP site does not mean you are hacked. The real risk is your personal data sitting on sites that have not patched yet. For crypto users, a hijacked project website never has to touch your wallet directly. It only needs to swap one script, so the "connect wallet" button you trust leads to code built to empty you. The fix already exists. The PHP Project has shipped patched versions: 8.2.35 8.3.36 8.4.27 8.5.12 If you run a website, here is the checklist: 1. Find every site and server running PHP, including the ones your host or developer manages for you. 2. Update PHP itself to a fixed version and restart it. Theme or plugin updates alone do nothing here. 3. If you cannot patch today, take the site offline until you can. 4. Check logs, unknown admin accounts, and changed files for signs someone already got in. 5. Get written confirmation from your host or developer that the patch is live. And ignore any message offering a "PHP security update" or asking for passwords and payment. Real patches never arrive in your DMs. AI just made the gap between a hidden bug and a live attack shorter than most companies take to patch. The ones still waiting are already late.
