A critical vulnerability in PHP has turned a routine software update into a global cybersecurity emergency, forcing governments and organizations to choose between taking websites offline and risking exposure to attackers.

PHP powers a vast share of the internet—possibly as much as 70% of websites—and the newly identified PHP2Shell flaws could allow remote code execution on affected servers. The conservative framing emphasizes the scale and severity of the threat: the PHP Foundation reportedly described it as the most serious flaw the language has faced in more than a decade, while researchers warned that AI could make exploitation easier for criminals.¹

Governments have responded cautiously. Canada temporarily pulled some federal websites offline after its cyber authorities advised protective action, with Artificial Intelligence Minister Evan Solomon calling it “a global issue” and urging operators to install updates quickly.² Reports from Europe described a broader disruption, including government, identity-service and local-council websites taken down while administrators patched their systems.³

The liberal perspective places the incident in a wider institutional and technological context. U.S., British, European and other national security agencies issued warnings, while Amazon reported detecting attempted exploitation before public disclosure. Google and OpenAI said AI systems helped discover, test or investigate the flaws—though the role of advanced models remains contested. OpenAI called the vulnerabilities among the most significant in recent memory, highlighting AI’s potential to defend infrastructure and to accelerate future attacks.⁴

The disagreement is less about the immediate remedy than about what the episode reveals. Authorities broadly agree that systems should be patched or taken offline; experts differ over whether the central lesson is the extraordinary power of AI or the longstanding neglect of basic maintenance. One researcher described the problem as an “environmental problem” in an industry incentivized to deploy software and “never update it.”³ That tension will persist well beyond this patch cycle: AI may find vulnerabilities faster, but outdated infrastructure still determines how widely they spread.