# Hackers got a four-day head start on the PHP2Shell vulnerability

> Original title: Hackers got a four-day head start on epic PHP2Shell vulnerability

- Source: Ars Technica · AI
- Published: 2026-10-22T15:25:02.000Z
- Bad Influence: https://badinfluence.news/items/rp3ov6li2b7gd9ma86vr402ai
- Original: https://arstechnica.com/security/2026/10/hackers-got-a-four-day-head-start-on-epic-php2shell-vulnerability/

## Summary

Researchers at Calif and Wiz discovered the PHP2Shell vulnerabilities, which the NSA says can give direct access to a server's file system or database. OpenAI says frontier AI found the flaws before attackers did, and that the same capabilities can help attackers build exploits. Wiz estimates PHP powers about 70 percent of websites, and the NCSC urges UK organizations to act immediately.

## Why it matters

The article links an AI lab's role in finding the flaws with the four-day gap before disclosure, a tension behind the security debate over frontier AI.