Key Takeaway:
- AI tools discovered long-hidden PHP flaws, triggering critical PHP security patches and emergency global website updates.
- Security agencies urged operators to update systems or take vulnerable sites offline immediately.
- Experts warned that improving AI capabilities will accelerate future vulnerability discovery.
Security researchers using artificial intelligence have uncovered critical flaws in PHP, prompting governments and website operators worldwide to apply emergency fixes or temporarily take vulnerable websites offline to prevent cyberattacks.
AI Helps Researchers Find Long-Hidden Security Flaws
Critical PHP security patches address vulnerabilities in PHP, an open-source programming language used to run websites and web applications. The flaws could allow attackers to execute code remotely, access sensitive information, and compromise computer systems. PHP supports roughly 70% of websites where the server-side programming language is known, according to cybersecurity researchers.
OpenAI, Google-owned cybersecurity company Wiz, and security research company Calif helped identify the vulnerabilities. Researchers found the flaws with the assistance of AI tools, including OpenAI’s GPT-5.6 Sol and Google’s Gemini 4 Argon.
OpenAI said Calif identified one critical flaw through its Patch the Planet initiative, while Wiz independently discovered and reported vulnerabilities in PHP. The teams worked with PHP maintainers and other cybersecurity providers to test fixes and prepare protections before publicly disclosing the findings.
“Given the severity of these flaws and PHP’s widespread use, we consider this one of the most impactful security issues in recent memory,” OpenAI said in an Oct. 21 blog post.
The vulnerabilities had existed for years, but advances in AI made them easier to identify and exploit. The findings highlight how the technology can strengthen cybersecurity while also lowering the technical barriers for potential attackers.
Governments Urge Websites To Apply Emergency Fixes
The PHP Foundation released Critical PHP security patches and urged website operators to upgrade affected systems. The U.S. National Security Agency and FBI also warned organizations about the vulnerabilities and recommended taking affected websites offline if administrators could not install updates immediately.
Some government and public websites in Europe and the United States became temporarily unavailable as operators worked to protect their systems. The Finnish government’s website was partly accessible on Wednesday while officials addressed the disruption.
“The potential impact is enormous,” said Ismael Valenzuela, vice president of labs, threat research and intelligence at cybersecurity company Arctic Wolf, according to The Associated Press.
Valenzuela said the flaws put a significant share of internet-based business and commercial infrastructure at risk. He stressed that not every website is vulnerable but said the findings require immediate attention.
Websites built using WordPress may also require action because the platform relies on PHP. WordPress sites are not uniquely affected by the flaws, but their operators must ensure their underlying PHP installations receive the appropriate security updates.
Experts Warn AI Could Accelerate Future Cyberattacks
The discovery highlights a growing challenge for cybersecurity teams: AI can identify weaknesses faster, but attackers may also use similar tools to develop exploits and target unpatched systems.
Raghu Nandakumara, vice president of industry strategy at cybersecurity company Illumio, said security teams must balance rapid vulnerability detection with controls over increasingly capable AI systems.
“The faster AI becomes at finding weaknesses, the more important it becomes to think about what happens after those weaknesses are exposed,” Nandakumara said, according to The Associated Press.
He warned that organizations may struggle to update every affected system quickly, creating risks even after researchers disclose a flaw and developers release a fix.
OpenAI said its researchers believe AI identified the PHP vulnerabilities before attackers did, giving maintainers time to prepare Critical PHP security patches. However, the company warned that similar discoveries could increase sharply as AI capabilities improve.
For website operators, the immediate priority is to identify affected PHP versions, install the appropriate patches, and follow guidance from their hosting providers. Organizations unable to secure exposed systems should consider taking them offline until they can apply effective protections.
Visit more of our news! CyberPro Magazine
