A Decade-Old PHP Flaw Triggered Millions of Exploit Attempts

? alex-stamos described the past month as one of the wildest in cybersecurity. The PHP vulnerability drawing headlines is part of a broader run of flaws and breaches, he said, but it illustrates how quickly an old weakness can become a large-scale intrusion once attackers can find and exploit it at speed.

PHP remains widespread, even though Stamos said it is uncommon in major enterprise applications. Companies often use it for smaller projects, marketing sites and web applications, and it underpins hosting platforms such as WordPress. The vulnerability was found through OpenAI’s “Hack the Planet” program, which gives approved researchers access to models for vulnerability research. Security consultancy CALIF used the program to find the flaw several months ago.

The vulnerability is a pre-authentication remote code execution bug: an attacker can run code on a vulnerable server without an account or other special access. A site’s login screen does not protect it. The flaw is also difficult to remediate across the PHP ecosystem. The patch applies to the latest PHP family, and organizations running older versions may have to refactor their code to upgrade. Stamos said unofficial backports and patches exist, but are less widely available.

The patching challenge collided with a disclosure process that was already underway. Coordinated disclosure usually begins with a small group and expands as vendors prepare fixes. In this case, Stamos said, information began leaking before the public announcement, and there is evidence attackers were exploiting the bug beforehand. The timing of a controversial patch release prompted debate, he said, but he suggested the person who released it may have had reason to do so.

Once an attacker takes over a server, the consequences can extend well beyond the website itself. The attacker gains access at the level of the web server, which may expose the site’s live activity and database. It can also provide a foothold in the organization’s production network, from which attackers may probe for other systems to compromise.

Ranjan Roy asked whether attackers would take sites down or reach into their underlying data. Stamos said many attackers first compromise as many systems as possible, then decide what is valuable. That can mean automated attempts across millions of sites, followed by data theft, malware installation or ransomware. Some attackers may copy entire databases first and assess them later: most of the data may be worthless to them, but a small portion could be useful.

Stamos described a Chinese “cottage access industry” that breaks into large numbers of systems and later sells access. He compared it to a market for hacking, while cautioning that it is not literally a full eBay-like site. In his account, an organized ecosystem can prevent multiple actors from tripping over one another as they pursue targets. He cited an earlier Microsoft SharePoint vulnerability in which Chinese access vendors broke into roughly 80,000 internet-facing sites and later sold access to Chinese companies.

Attackers may also try to keep control once they get in. Stamos said they sometimes patch the vulnerability themselves to stop other groups from removing their malware or taking over the compromised system. The immediate intrusion, then, may be only the first step: attackers can later select high-value targets from the systems they control, steal data or move further into a company’s network. Stamos said AI agents could automate later stages of an attack, though he had no good estimate of how often that was happening in this case. He described automated AI attack chains used by a Chinese group against South Korean banks as an example from another situation.

The scale of attempted exploitation was rising sharply. One of the hosts cited figures from Cloudflare CEO Matthew Prince: the network saw thousands of attempts in the 10 hours before the PHP flaw was publicly announced, tens of thousands in the first 45 minutes after the announcement, hundreds of thousands within two hours, and millions by the time of the discussion.

For organizations that cannot investigate an intrusion themselves, Stamos said, finding outside help may be difficult. Incident-response firms were already booked before the PHP disclosure, leaving companies to conduct their own forensics or recovery. He expected breach notifications to appear over time, particularly from companies with security teams capable of detecting and investigating an intrusion.

Patching does not establish that a system was never compromised. Stamos warned that companies may fix the vulnerability without realizing an attacker gained access during the period before the patch was applied. Those attackers could use an existing foothold to penetrate further into a company over the following months. Ransomware groups may directly demand payment; government-linked attackers may remain unnoticed unless investigators find evidence such as their infrastructure.

Stolen passwords create a separate risk for individuals. Stamos said password reuse is the most common way a person gets hacked. If attackers obtain large collections of credentials, a password used across multiple sites could also unlock email or banking accounts. Email access is especially consequential because it can often be used to reset other passwords. He expected more fraud and spam over the next six months, including targeted texts and calls that exploit leaked information about people’s relationships and phone numbers.

His immediate recommendation for individuals was to use a different password for every site, preferably through a password manager, and change reused passwords that may have been exposed. He also urged people to be more selective about where they share personal information. Someone cannot perform formal vendor-risk checks on every service, he said, but can still question whether an unfamiliar forum or low-trust site deserves their data. He suggested using secondary email accounts for less important services, keeping them as separate from a person’s main identity as possible, and treating unexpected messages and calls with greater suspicion.

Stamos’s broader concern was that the threat level may stay elevated. He compared the change to moving from a bad neighborhood to a much more dangerous one: people had always been exposed to risk, but a limited number of attackers meant that many could get by without much caution. The current pace, he said, may ease from its recent peak without returning to the previous baseline for several years.

The PHP vulnerability was not the only concern. Within roughly a day, Stamos said, a series of significant Node.js flaws had also surfaced. Node is more likely than PHP to be used by large enterprises; the bugs were more complicated to exploit, but still serious. He also pointed to other breaches over the preceding weeks, including the theft of certificates from a certificate authority. Stolen certificates can allow attackers to create certificates that appear trusted, though Stamos noted that the mechanics are more complicated than that shorthand suggests.

The hosts called the cluster “Black October,” citing a list that included PHP, Node.js, Java, GitLab, Railway, Signal, WordPress and LiteLLM. Stamos agreed with the label but drew a distinction among the incidents: breaches at companies such as Railway and Fireworks were almost certainly not caused by the PHP flaw. He said some attacks on companies supplying infrastructure to the AI industry appeared to be professional operations. His assessment was that they might involve commercial vendors doing state-level work, given the targets, which included companies important to the AI ecosystem and cloud-hosting providers. Access to API keys at a hosting provider, for example, could enable access to cloud resources.

For companies, the crisis is also a discovery problem. Organizations were asking vendors whether they used PHP or Node and what they had done to fix vulnerabilities. But Stamos said the more fundamental issue is that many companies may not know what they have exposed. A conference website built years ago may still be running, along with other forgotten projects and cloud-hosted services that never made it into an organization’s picture of its own perimeter.

If those systems are properly isolated, compromising one may have limited consequences. But Stamos said too many organizations put exposed systems in a network area where attackers can reach other servers. A compromised site might also hold registration data, leading to theft, extortion or a required breach notification. The forgotten website is not necessarily important in itself; its value may come from what it connects to or what information it retains.

The discussion also raised the role of government response. Stamos said the NSA and CISA had published material on the issue, but argued that the US government had lost defensive cyber capacity in recent years. He attributed that decline to political appointees who opposed CISA’s work on election security, and said the situation underscored the need for capable public-sector teams to coordinate responses.

Stamos separated fears about AI agents that behave unexpectedly during evaluation or training from the risk of people deliberately handing agents access to sensitive accounts. He said the industry had made changes to reduce agents “escaping” during testing, though he did not claim the problem was solved. He also argued that a model independently going rogue and hacking people was not the immediate threat individuals should focus on.

The more direct danger, in his view, is a user giving an agent broad credentials and asking it to manage finances or file taxes. Banks are seeing interactions that appear to come from bots but use valid authentication rather than stolen credentials. Stamos said some agent products had gained popularity partly by finding ways around companies’ automated bot-detection systems—the same protections designed to prevent automated access to sensitive services.

That creates a conflict between institutions trying to prevent bots from acting on customers’ behalf and customers who want the convenience of handing over logins and personal data. Stamos called it risky to give an entire password manager to a company that has existed for only a short time. The danger is not that every agent will act maliciously; it is that users may grant consequential access to tools and services before they have reason to trust how that access is handled.

Stamos pushed back on the idea that OpenAI or Anthropic should be blamed for the PHP vulnerability. The flaw had existed for about a decade, he said, and other bugs being found or fixed with help from AI had also been present for years. Widely distributed open-source software is difficult to repair, and he argued that the bug was handled as well as it could have been under the circumstances. Without this research, he said, the vulnerabilities would still have been found—potentially by open-weight or Chinese models.

His concern is that AI increases what individuals can do in reverse engineering and exploit development. Stamos described running a heavily quantized open-weight model on a Mac Studio and finding that it made him feel much more capable of reverse engineering and writing exploits. He argued that the broader concern is not limited to researchers discovering flaws faster: attackers may also be able to sustain a higher operational pace.

For Stamos, the long-term answer includes replacing large amounts of software that underpins the internet. He argued that applications written in languages without type and memory safety should be refactored rather than left in place indefinitely. Rewriting them would have been impractical five years ago, he said, but current models make it possible to refactor some systems far faster; he cited examples of old SAP-based software rewritten in eight days. That kind of work still requires money, time, access to strong models and a willingness among open-source communities to replace old systems.

The scale of the task is substantial. Stamos said the industry may face two, three or five years of difficult adjustment, while also arguing that AI has made a broad rewrite more feasible than it was before. He hoped that the recent wave of vulnerabilities would help direct enough funding—and computing resources—toward that work. The immediate demand is to patch exposed systems and investigate intrusions. The longer-term argument is that faster discovery cannot substitute for removing the old weaknesses it exposes.