PHP Security Flaws Raise Global Cybersecurity Concerns as Tech Leaders Warn of More Attacks

Senior technology leaders are warning of further cybersecurity incidents after critical vulnerabilities were discovered in PHP, prompting several websites to go offline while security teams rushed to install fixes and protect their systems. With PHP estimated to power nearly 70% of websites, the discovery has raised wider concerns about internet security. Nikesh Arora, CEO of Palo Alto Networks, and Sriram Krishnan, who briefly served as a senior White House policy adviser on AI, have cautioned that more incidents could follow.

“I'm more concerned about what comes next. This is just one. There's more to come,” Arora said in an interview with TBPN, hours after the PHP vulnerabilities became public. He also expressed concern that some individuals might hunt for vulnerabilities to gain what he described as “street cred”, treating major discoveries like trophies to demonstrate their technical abilities.

“The problem is when you start seeing big things like this happen, you start finding people who are trophy hunters. They're going to say, ‘Where can I find the next PHP and prove to the world that I'm as smart as the last guy,’” Arora said.

PHP is a widely used programming language that supports websites and web applications. The newly identified flaws could allow attackers to gain remote access to vulnerable platforms. Although security fixes have been released, the incident has highlighted the risks associated with software used across a large portion of the internet. According to W3Techs, PHP powers an estimated 70% of websites, underlining the potential scale of the exposure.

Arora suggested that uncovering a major weakness in widely used software could become a source of recognition among hackers. “If you're a hacker, isn't that a street cred that I found that one?” he said, referring to the reputation someone might gain from discovering a significant vulnerability.

He added that several people contacted him shortly after the PHP security flaws were disclosed. “The moment this happened, I had four people message me saying, I found it, or I found it,” Arora said.

However, he stressed that identifying such vulnerabilities should not be treated as an achievement without considering the risks they pose to websites and their users. “I'm like, ‘dude, this is not a good thing,’” he said.

The two vulnerabilities, collectively nicknamed “PHP2Shell”, could reportedly enable attackers to take control of affected web servers without prior access or authentication. The US National Security Agency (NSA) and the Federal Bureau of Investigation (FBI) issued warnings about the threat. The NSA advised organisations to take affected systems offline if an immediate update was not possible, stating: “If an immediate update is not feasible, it is recommended that organizations take the system offline until it can be fully mitigated,” the agency said.

Software Supply Chains Need Stronger Security

Researcher Calif.IO reportedly used OpenAI's GPT-5.6 Sol AI model to help identify the vulnerabilities, which had allegedly remained undetected for more than a decade. The discovery highlights how AI tools can accelerate security research and help researchers uncover weaknesses that may have persisted in software for years.

Sriram Krishnan shared a similar concern on X, warning that AI-assisted vulnerability discovery could become more common. “I think today’s PHP disclosure is a harbinger of things to come. these models will make us all safer by finding long lurking issues. However, the entire software supply chain will need the muscles to rapidly build and deploy fixes. We might need a lot more public + private partnerships to secure infrastructure across the country.”

The PHP Foundation released an emergency security update on October 21. After its release, several government websites in the European Union reportedly went offline as organisations applied the fixes. The Wikimedia Foundation also took some systems offline as a precaution, affecting access to parts of Wikipedia.

Cloudflare CEO Matthew Prince reported a sharp rise in attempted exploitation following the public disclosure. In a post on X, he said: “In the 10 hours before it was publicly announced, across the Cloudflare network we saw thousands of attempts to exploit it,” he wrote on X. “That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.”