Security researchers have identified two critical vulnerabilities in the PHP programming language, which is used by roughly 70% of websites worldwide. One of the flaws was found in part with the help of an OpenAI model; governments and security teams from the United States to Japan have urged immediate patching or temporary takedowns to reduce the risk of exploitation.
What happened
Researchers discovered two issues in the open-source PHP runtime that attackers could relatively easily exploit. OpenAI acknowledged that one of its models played a role in uncovering a vulnerability, enabling PHP maintainers to develop a patch.
Some site operators temporarily took services offline on Wednesday — including certain Wikipedia services and parts of 4chan — to give themselves time to apply fixes.
Why it matters
Exploitation of these flaws would allow attackers to gain control of vulnerable servers without needing passwords or other credentials. Because PHP underlies a wide range of internet applications, such access could enable website takeovers, theft of sensitive data, and website tampering.
Wiz researchers stated that the findings "rank among the most severe vulnerabilities discovered in PHP, and arguably in software history." They also noted that demonstrating exploitability required "an exceptionally complex chain of steps," which helps explain why the bugs remained undetected for decades.
The role of AI and its implications
The discovery highlights a dual reality brought by AI in cybersecurity: the same capabilities that help defenders find bugs can also accelerate attackers' development of offensive tools. In a Wednesday blog post, OpenAI said the example illustrates how AI can uncover internet-scale security flaws.
Security researchers have long been cautious about AI-generated vulnerability reports because many such reports have turned out to be minor issues or false positives. This PHP case may force the community to reassess how it treats AI-derived findings and the speed at which they can translate into real-world threats.
Threat level and recommended actions
If exploited, the PHP vulnerabilities would let malicious actors seize servers without credentials. As a result, governments and security teams have urged companies and operators to apply patches immediately or, if necessary, take affected services offline until systems are secured.
Michael Leland, field CTO at Island, told Axios by email that defenders have historically relied on the time gap between "vulnerable" and "exploitable" to deploy patches — that gap is rapidly closing.
What to watch next
Security teams expect a potential rise in incidents over the coming weeks as attackers may try to weaponize these PHP flaws. The discovery also reinforces concerns about the fragility of modern internet infrastructure, which depends heavily on volunteer-maintained open-source software.
Summary
Two critical PHP vulnerabilities, partially identified with AI assistance, present a significant risk to websites worldwide. Rapid patching and proactive defensive measures are essential while the cybersecurity community and policymakers confront the broader implications of AI-enabled vulnerability discovery.
