AI-Discovered PHP Vulnerabilities Trigger Global Website Security Alert
Governments and organisations have taken some websites temporarily offline as they respond to critical security vulnerabilities discovered in PHP, a programming language widely used to power websites and web applications. The flaws could allow attackers to execute malicious code remotely, potentially exposing sensitive information and putting computer systems at risk.
The security concerns came to wider public attention on Wednesday, October 21, after the PHP development team released emergency updates addressing two critical vulnerabilities. According to the official security advisory, the flaws can allow unauthenticated remote code execution, meaning an attacker may be able to run malicious code on an affected system without first logging in. The US Federal Bureau of Investigation’s cyber division warned organisations to apply the fixes immediately or take affected websites offline if they could not update them in time.
The vulnerabilities prompted temporary disruptions to some online services in Europe and the United States as organisations worked to secure their systems. Finland’s government website was among the services reported to be partly unavailable during the response. Cybersecurity experts have warned that the potential impact is significant because PHP is used across a large portion of the internet. An estimate cited by The Associated Press suggests PHP powers roughly 70 per cent of websites whose server-side programming language is known, although this does not mean that all those websites are vulnerable.
The vulnerabilities were identified through research involving artificial intelligence tools as part of OpenAI’s Patch the Planet initiative. OpenAI said cybersecurity firm Calif identified a critical flaw using its GPT-5.6 Sol model, while security company Wiz independently discovered and reported both vulnerabilities. Researchers, software maintainers and security providers worked together over the past two months to prepare fixes and protections before the issues were publicly disclosed.
OpenAI described the findings as among the most impactful security issues in recent memory, highlighting AI’s growing ability to identify weaknesses in widely used software. However, the development also raises concerns about the potential for similar AI capabilities to help malicious actors discover and exploit security flaws more quickly.
The PHP development team has released patched versions of PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The official advisory urges users of affected installations to update immediately, noting that there are no complete alternatives to applying the fixes. Organisations using older versions should check with their hosting providers or software distributors to establish whether security updates are available.
The incident highlights the growing role of artificial intelligence in cybersecurity, both as a tool for identifying vulnerabilities and as a technology that could accelerate cyberattacks if misused. For website owners and administrators, the immediate priority is to establish whether their systems are affected, install the appropriate security updates and verify that their websites are running protected versions of PHP.
