Global Cyber Alert After AI Uncovers Critical PHP Flaws
A critical security crisis is unfolding across the internet as researchers report the discovery of severe, long-hidden programming vulnerabilities within PHP.
This programming language has been a cornerstone of web development since the early 2000s, underpinning a vast array of platforms ranging from massive online encyclopedias like Wikipedia to WordPress blogs and various e-commerce storefronts.
Experts at the cyber-security firm Wiz, who participated in identifying the flaws, have labeled them the “most severe” issues ever detected by artificial intelligence.
OpenAI, which provided the AI technology used in the discovery, described the findings as “one of the most impactful security issues in recent memory.”
The vulnerability creates a pathway for attackers to potentially seize control of web servers without needing authentication, exposing sensitive data to theft. Paul Spain, chief executive of Gorilla Cyber Security, explained that PHP serves as the bridge between raw data and what users actually see on their screens. He noted that the nature of these flaws could affect “millions and millions” of websites, adding that AI could significantly accelerate the speed and ease of such exploits. Researcher Jill Slay from the University of Adelaide warned that it would be “disastrous” should malicious actors or state-sponsored entities weaponize these vulnerabilities to harvest private information. AI could make such attacks easier and faster, Spain said, estimating that the flaw could affect “millions and millions” of websites. Particularly those belonging to smaller organisations with limited security resources, at greater risk, some experts warn the vulnerability could leave poorly maintained websites. What happened after the flaws were exposed. It is unknown how the potential attackers knew about the vulnerability.
The global response has been swift and disruptive. Wikimedia, the parent organization for Wikipedia, proactively took several systems offline to safeguard data. Multiple government entities and public organizations, including the Finnish government, the Netherlands’ cyber-security agency,, and Edinburgh council, also suspended their web services. In Scotland, various health boards and local councils followed suit. University networks, such as those at the University of Geneva, were similarly impacted by precautionary outages. Meanwhile, Amazon confirmed that it was targeted in several exploitation attempts prior to the public disclosure of the security gap.
Developers behind the PHP platform have released emergency patches to address the security defects, which had remained dormant in the software for years.
Users have been strongly advised to apply these updates immediately.
The US National Security Agency (NSA) has issued a directive urging organizations to maintain “heightened awareness” and ensure that all patches are applied with urgency, noting that if an immediate fix is impossible, affected platforms should be taken offline to prevent a “direct path” to database exploitation. The UK’s National Cyber Security Centre provided similar guidance, emphasizing the need for administrators to scan for any backdoors installed by unauthorized parties.
The alert has expanded globally, with authorities in Australia, Singapore, and across the European Union issuing urgent warnings. In Japan, Prime Minister Sanae Takaichi took to social media to urge operators of public websites to verify if their platforms rely on PHP, suggesting that temporarily suspending services is a valid and effective risk-reduction measure if patching cannot be completed immediately. This scramble highlights a broader issue in software architecture: many foundational components of the internet were originally built with a focus on functionality rather than robust security, as noted by Ryan Ko of the University of Queensland’s Cyber Research Centre. Serious flaws had gone undetected in the technology underpinning much of the internet, for more than a decade. We have an urgent request for everyone to take action tonight,” Takaichi wrote on X.
While the technical details behind the vulnerabilities were previously obscure, their public release this week has prompted concerns that exploit attempts will intensify. According to Salil Kanhere of UNSW Sydney, the underlying bugs were not necessarily new, but our ability to identify them has been transformed by AI. The discovery underscores a double-edged reality where AI can effectively uncover hidden security flaws, while simultaneously assisting attackers in rapidly developing offensive tools. To assist in the cleanup, OpenAI has made a specialized program available to help users determine if their PHP environment remains secure. Most people may not have heard of PHP – short for PHP: Hypertext Preprocessor – but they most certainly interact with it daily.
For the average user, the priority is vigilance. Website administrators are being urged to treat these patches as a routine but essential maintenance task. While the burden of securing platforms falls heavily on operators, users are advised to stay alert for security notifications from the services they use, such as prompted password changes, and to remain cautious of potential phishing attempts that may try to leverage the current news cycle regarding these vulnerabilities.
