AI Discovers Critical PHP Vulnerability Threatening Global Internet Security

POLICY WIRE — Washington, United States — The foundational language that serves as the backbone of the internet is currently facing what experts have characterized as one of the most prominent security vulnerabilities in recent memory.

PHP functions as a widespread general-purpose scripting language tailored for web development, powering the overwhelming majority of websites across the globe. Following warnings issued on Wednesday by the organization overseeing the language and the FBI cyber division regarding significant software vulnerabilities, government entities and private corporations worldwide scrambled to respond.

Official sites for PHP and various other organizations published security advisories urging users to immediately apply patches for two critical flaws or completely shut down their web servers if updates were unavailable. The PHP Foundation explained that these security gaps could allow bad actors to secure unauthenticated access to systems running the language.

James Sullivan, director of cyber and tech at the Royal United Services Institute in London, explained that this flaw permits attackers to control a web server remotely without needing a password. Such capability empowers malicious actors to steal or alter data, or leverage the compromised infrastructure to launch secondary cyberattacks.

Given that PHP powers roughly 70% of websites globally, the potential scope of exposure is massive. The language’s open-source and free nature drives its massive popularity, serving as the core engine behind content management systems like WordPress and Drupal, which many governments use, alongside MediaWiki, the software powering Wikipedia.

In response to the security bulletins, several web platforms went dark to mitigate risk while technicians implemented fixes, leading to service disruptions across government websites and online portals in nations including the United Kingdom, Finland, and Japan. Organizations continue to await specialized patches for various software configurations and must thoroughly test updates before deployment.

According to the PHP Foundation, these underlying weaknesses have been known since at least 2024, though some experts suggest they may have existed even longer. Although security teams previously explored multiple potential solutions, competing approaches carried drawbacks and a practical exploitation method seemed unlikely at the time, leading progress to stall.

The foundation accepted responsibility for the prolonged inaction, stating that the delay was a structural failure driven by the security team’s decision-making process and an lack of resources. The situation shifted dramatically when artificial intelligence agents helped surface the flaws.

OpenAI revealed in a blog post that it spearheaded a collaborative effort over the preceding two months alongside researchers and security providers to tackle PHP security issues. Simultaneously, cloud security platform Wiz reported that its researchers independently leveraged artificial intelligence to pinpoint the vulnerabilities.

The broad accessibility of artificial intelligence equips large and small organizations with advanced capabilities to proactively and reactively defend their networks, but it also arms malicious actors with sophisticated tools to exploit digital weaknesses at scale. Sullivan noted that while this technological push-and-pull remains concerning, the current scenario highlights a positive outcome where AI successfully exposes critical vulnerabilities so the global community can unite to remediate them.

Reporting by Policy-Wire (PW)