AI discovers severe security flaws in PHP programming language

The PHP vulnerability

For over a decade, serious flaws remained hidden in the technology that powers much of the internet. These vulnerabilities were recently brought to light by artificial intelligence, triggering a global cyber-security scramble. The issues reside in a programming language called PHP (short for PHP: Hypertext Preprocessor).

PHP has been used internationally since the 2000s to build websites. It is the code responsible for collecting information and presenting it to users. If you visit a site like Wikipedia, PHP is the engine working behind the scenes to make that content readable on your screen.

Because PHP is so common, it powers a vast array of platforms. This includes online shops, WordPress—the content management system used for many blogs—and the Wikimedia organization. The flaw is particularly dangerous because it could allow an attacker to take control of an affected web server without any authentication, potentially leading to the theft of sensitive data.

A global security response

The discovery caused immediate disruption across the globe. Cyber-security agencies and governments scrambled to contain the fallout on Wednesday. Many organizations took the drastic step of taking their websites offline entirely as a precautionary measure. This included the Finnish government, the Edinburgh council, the BBC, and the Netherlands' cyber-security agency.

The US National Security Agency issued a stern warning to all organizations using PHP. They stated that the flaw could provide a "direct path" to exploit a system's database. The agency urged departments to take systems offline if they were unable to apply an emergency fix immediately. The UK's National Cyber Security Centre gave similar advice, telling organizations to look for any backdoors that an attacker might have already installed.

In Japan, Prime Minister Sanae Takaichi urged the public to check if their websites ran on PHP. She requested that people take action immediately, noting that suspending websites is an effective way to reduce risk if a prompt fix cannot be applied. Security experts warn that poorly maintained websites, especially those belonging to smaller organizations with fewer resources, are at the highest risk of being targeted.

How AI found the flaws

The vulnerabilities were uncovered by researchers at the security firms Calif and Wiz. They used advanced AI tools capable of analyzing code to find flaws much faster than humans or older systems can. As cyber-security researcher Salil Kanhere from UNSW Sydney explained, the underlying bugs were not new; rather, the ability to find them changed with the rise of AI.

OpenAI, whose technology was used in the discovery, called the find one of the most impactful security issues in recent memory. The company noted that while AI can uncover these flaws, it can also help attackers rapidly develop offensive tools and exploits. Many of these issues stem from older software built for functionality rather than security.

The PHP platform developers have since rolled out patches to fix the vulnerabilities. They are strongly encouraging all users to update their software immediately. Because the technical details of the flaw are now public, researchers expect more attempts to exploit the bugs in the coming weeks. The incident serves as a major milestone in how AI is being used to audit the complex infrastructure of the modern web.

Protecting your data

The primary responsibility for securing these systems lies with website operators. They are being urged to update to the latest version of PHP as quickly as possible. The US National Security Agency has called for heightened awareness and constant monitoring of updates from software vendors.

For the general public, the risk is indirect but significant. While you cannot patch a website you do not own, you should stay alert for security advice from your favorite services. This might include requests to change your passwords or other security prompts from platforms you use regularly.

Experts also warn of a secondary risk: phishing. Because this story is receiving so much attention, hackers may try to use the publicity to send fake messages. Users should remain vigilant and be cautious of any messages that try to exploit the news of the PHP vulnerability to steal personal information.

What's next for PHP

The immediate priority is the global rollout of the emergency patch. Developers are working to ensure that the millions of websites using PHP can be secured without breaking the functionality of the sites. However, the discovery highlights a growing trend where AI is used to find deep-seated bugs in legacy code.

Moving forward, the tech industry will likely see a shift in how software is audited. If AI can find flaws that have existed for a decade, it will become a standard tool for security teams to scan for vulnerabilities before they can be exploited. This creates a new arms race where security firms use AI to defend systems while attackers may use it to find new ways in.