AI-assisted PHP flaws prompt federal cybersecurity warning

Researchers using artificial intelligence uncovered two decade-old vulnerabilities in PHP, prompting a federal warning and renewed concern that AI may help attackers find and exploit software flaws faster than organisations can patch them. PHP developers released fixes and urged users to update affected software. The Cybersecurity and Infrastructure Security Agency added the vulnerabilities, known collectively as php2shell, to its catalog of actively exploited flaws and ordered civilian federal agencies to remediate affected systems by October 29, 2026. The deadline has passed, but the reports do not establish whether every agency completed the work. PHP is used by an estimated 70% of websites, according to reports describing the vulnerabilities. Researchers said AI helped identify the flaws, which had remained undiscovered for about a decade. Successful exploitation could allow malicious code to run on affected servers, potentially exposing information or connected systems. Some organisations temporarily took websites or systems offline while assessing risk and applying updates; the reports do not establish that those precautionary shutdowns resulted from successful attacks....