OpenAI says its AI found the PHP2Shell bugs before attackers did, and Amazon says it saw hackers trying to use them four days before the rest of us were told they existed. That lead doesn’t last long when the other side has AI too, or when a hint of exposure slips out while the fix is still being developed.
If you run a website, PHP is probably somewhere underneath it. Wiz says it powers about 70% of the web, mostly because WordPress is built on it. The National Security Agency’s advice was blunt: update right away, or take the site offline until you can.
Two things I’d do now:
・ Count your WordPress sites. Then count again. That campaign microsite that marketing launched in 2019 is on that list, and so is the one an agency still hosts for you.
・ Decide today who gets to say “take it down.” Pulling a public site is a business call, and you don’t want to be hunting for that person at 2 a.m. during an active attack.
Patch today, and then go find the sites you forgot you had!
#CyberSecurity #WordPress #AI #PHP #security #privacy #cloud #infosec
Ars TechnicaHackers got a four-day head start on epic PHP2Shell vulnerabilityHackers were already probing the bug before defenders were told it existed.