Hackers gained a four-day head start on the critical PHP2Shell vulnerability

Researchers at the two U.S. cybersecurity organizations Calif and Wiz discovered the PHP2Shell series of vulnerabilities in PHP; OpenAI said that, to its knowledge, frontier AI discovered these vulnerabilities before attackers, and worked with PHP, Calif and Wiz to verify them and develop patches, but hackers still acted four days earlier. Wiz estimates that PHP supports about 70% of websites worldwide, mainly because WordPress is written in PHP. The NSA said such vulnerabilities can often lead directly to a server's file system or database, and advised taking systems offline when immediate updates are not possible; the U.K. NCSC said the vulnerabilities could let hackers control website servers without login credentials such as passwords, and urged U.K. organizations to act immediately. The White House said federal agencies are assessing the potential impact of the vulnerabilities on government systems and critical infrastructure; OpenAI also cautioned that the same AI capabilities could help attackers rapidly develop attack tools.