Hackers got a four-day head start on epic PHP2Shell vulnerability

Researchers at Calif and Wiz discovered critical PHP vulnerabilities that the NSA warned can provide a direct path to a server's file system or database, urging organizations unable to update immediately to take systems offline. Wiz estimated PHP powers about 70 percent of the world's websites, and OpenAI said frontier AI found the flaws before attackers did, calling it one of the most impactful security issues in recent memory. The UK's National Cyber Security Centre said the flaws could let a hacker take control of a website's server without a password or other login credentials.