AI discovers PHP flaw leaving 70% of global websites at risk

A global security emergency

A major cybersecurity crisis has emerged after a critical security flaw was discovered in PHP, a programming language used to build a vast majority of the internet's homepages and online stores. Because PHP is so common, the vulnerability puts roughly 70% of all websites worldwide at risk of being hacked.

The flaw, dubbed 'PHP2Shell,' is particularly dangerous because it allows attackers to execute remote code and seize control of a server in just a few seconds. Most importantly, it does not require any login credentials or authentication, meaning a hacker can bypass standard security gates entirely.

The threat is so significant that the South Korean government raised its cyber crisis alert level to 'Caution.' This move triggered a scramble to increase personnel and put emergency response teams on standby to handle the influx of potential incidents.

How AI found the hidden flaw

The most striking aspect of this discovery is that it was made by artificial intelligence rather than human engineers. During a security audit in August, a model known as 'GPT-5.6 Sol' successfully identified the vulnerability within the PHP source code. This specific flaw had remained hidden for years, even though some human security personnel had noticed the code previously.

Why did humans miss it? Experts suggest that while the code was visible, it was considered too technically complex for a human to believe it could actually be exploited in a real-world attack. However, the AI demonstrated that the flaw was indeed usable, leading to a declared state of emergency. Amit Yoran of the cybersecurity firm Wiz stated that the defect was too complex for human eyes to find without AI help.

The discovery was accelerated when information about the flaw leaked into developer communities on October 20. This forced the PHP developers to move up their timeline, releasing a patched version of the code earlier than they had originally planned on October 22.

The scope of the impact

The scale of the problem is massive because of how deeply PHP is integrated into the web. According to data from W3Techs, the sheer volume of sites using the language means that a single flaw can create a global emergency. In response, the U.S. National Security Agency (NSA) issued an advisory telling agencies to patch their systems immediately or take them offline entirely if updates cannot be applied quickly.

Several European nations have already taken action. The French Ministry of the Interior and the Netherlands' National Cyber Security Centre have both temporarily shut down their website operations to ensure they are not breached. In South Korea, the situation is particularly pressing because many organizations still run old versions of the software.

Security firm CybelAngel reported that roughly 25,000 servers in South Korea are running PHP version 8.1 or older. Because these older versions no longer receive official security updates from the developers, administrators are being urged to upgrade to version 8.3 or higher. If they cannot upgrade, they are advised to block all external access to the servers to prevent data leaks or website defacements.

The future of AI and security

This incident highlights a growing trend where AI will likely become the primary tool for discovering 'zero-day' vulnerabilities—security holes that are unknown to the software's developers. While this helps developers fix bugs faster, it also means that attackers could eventually use similar AI tools to find and exploit flaws even more quickly.

Cybersecurity experts are now calling for a shift toward proactive defense. Instead of waiting for a flaw to be discovered, they argue that governments and large corporations need to conduct comprehensive audits of every server they operate. Many companies currently do not have a complete map of their own digital infrastructure, which makes it difficult to know which systems are vulnerable when a crisis like this hits.

As open-source AI models become more accessible, the barrier for finding these flaws will continue to drop. This creates a permanent arms race where the speed of discovery by AI might outpace the speed of human-led defense, making automated, nationwide audits a necessity for maintaining internet safety.