Governments and companies around the world raced this week to patch two critical vulnerabilities in PHP, the programming language that underpins an estimated 70% of the internet's websites, after AI tools uncovered flaws that had gone undetected for more than a decade.
The bugs, nicknamed "php2shell," were disclosed by cybersecurity firms Wiz and Calif, working with OpenAI, after AI models from OpenAI and Google were used to probe PHP's code for weaknesses. Amazon, the world's largest cloud provider, said separately that it had detected hackers attempting to exploit the flaw four days before it was publicly disclosed — and that the bugs are now "being broadly exploited in the wild."
What the flaw does
PHP — formally PHP: Hypertext Preprocessor — is the back-end language behind Wikipedia, countless online shops and WordPress, the system that powers a huge share of the world's websites. Under the right conditions, Wiz said, the vulnerabilities could let hackers take control of an affected server and steal sensitive data without needing a password or other login credentials, leaving "everything built on PHP" exposed. Ryan Austin, the Calif researcher who helped uncover the issue, told the BBC it was "the most serious vulnerability I've ever found."
"Given the severity of these flaws and PHP's widespread use, we consider this one of the most impactful security issues in recent memory," OpenAI said in a statement, adding that "to our knowledge, frontier AI found these vulnerabilities before attackers did." The company warned the same capability cuts both ways: "It highlights how AI can uncover security flaws with internet-scale impact, but the same capabilities can also help attackers rapidly develop offensive tools and exploits."
A scramble to patch or go dark
The UK's National Cyber Security Centre warned the flaw could let an attacker seize a server without credentials and urged "immediate action." The US National Security Agency told all organisations running PHP to update immediately or take systems offline: "If an immediate update is not feasible, it is recommended that organisations take the system offline until it can be fully mitigated," the agency said. Developers maintaining PHP released patches for both flaws on Wednesday.
The disruption rippled across the internet within hours. Wikimedia, the organisation behind Wikipedia, took down a number of its own systems as a precaution. Government sites in Finland and the Netherlands went offline while being patched, as did services run by Edinburgh council and the BBC. The White House said federal agencies were still assessing the bugs' impact on government systems and critical infrastructure.
Paul Spain, chief executive of Gorilla Cyber Security, estimated the flaw could affect "millions and millions" of websites, and warned AI could make exploiting it both easier and faster for attackers. Jill Slay, a cybersecurity researcher at the University of Adelaide, said it would be "disastrous" if hackers or hostile states weaponised the bug to seize private data en masse.
A preview of AI-era cybersecurity
The episode lands amid wider unease over AI's growing cyber capabilities. New model releases from Anthropic and OpenAI earlier this year prompted warnings from lawmakers and financial regulators, and briefly led the US government to slow their rollout. This week's disclosure cuts the other way, cybersecurity officials say — evidence that AI can also be turned toward finding and fixing flaws before criminals do, provided defenders move fast enough once a vulnerability surfaces.
For now, the priority is simpler: patch or go dark. Security teams were still working through the weekend to confirm which of their systems run vulnerable PHP versions, and how many had already been compromised in the four-day window before the world knew to look.
