In brief
A new wave of AI‑driven code analysis has exposed serious flaws hidden for years in the popular PHP programming language. The discovery prompted an urgent global response from governments, security agencies, and major web platforms to patch or suspend affected servers. The bugs could allow attackers to hijack sites without authentication, threatening countless websites from e‑commerce to government portals. While patches have been released, experts warn that the rapid spread of AI tools also makes it easier for bad actors to develop exploits. Website owners and users alike are urged to update PHP versions and stay alert for phishing attempts tied to the incident.
For over a decade, secret flaws had slipped under the radar in the code that powers a huge portion of the web – until machine‑learning tools turned the spotlight on the PHP scripting language. The discovered bugs, found by researchers at CalF and Wiz using AI, could allow attackers to take control of servers without any user credentials and exfiltrate data from databases.
The revelation set off a worldwide scramble: governments, from Japan’s Prime Minister to the U.S. National Security Agency, advised web operators to apply emergency patches or shut down sites pending updates. Apache Software Foundation’s developers rushed to release fixes, demanding “immediate update” from all PHP users. Meanwhile, high‑profile services – including a major online encyclopedia, a leading neural‑network company, and a national news broadcaster – temporarily brought their sites offline.
PHP, the language behind e‑commerce platforms, forums, and content‑management systems like WordPress, has enabled millions of websites. Because the flaws can be triggered without authentication, experts warn that smaller organisations with limited security budgets are particularly vulnerable. The situation underscores both the power of AI in securing software and the risk that intelligent assistants can quickly turn into weapons of mass disruption.
OpenAI – which helped uncover the vulnerabilities – termed the incident “one of the most impactful security issues in recent memory,” adding that the new vulnerabilities stem from legacy code built for performance, not safety. As the technical details are now public, security researchers predict a surge in exploitation attempts.
Website owners are urged to upgrade to the latest PHP release, scan for any backdoor code, and monitor traffic for subtle anomalies. Users should remain vigilant for phishing emails that praise the “fix” and demand new credentials. In the coming weeks, both operators and ordinary internet users are advised to keep security patches up to date and verify the authenticity of any site updates.
The incident has highlighted the urgent need for continuous, AI‑augmented security testing and for the rapid deployment of patches. As the web community rallies to patch the holes, the broader lesson is clear: the same technology that exposes these threats can also become the most effective shield against them.
