Artificial Intelligence Uncovers Critical Decades-Old Flaws in Foundational Web Language PHP
Security officials across multiple nations are issuing urgent warnings following the discovery of two critical vulnerabilities in PHP, the open-source programming language that underpins nearly 70 percent of all websites. The findings represent one of the most consequential cybersecurity discoveries achieved with the assistance of artificial intelligence, exposing flaws that remained hidden from human developers for decades.
The discovery has prompted government agencies from the United States to Japan to advise companies to immediately apply available software patches or consider temporarily taking their web infrastructure offline to prevent potential breaches. The severity of the flaws led several major platform operators, including services at Wikipedia and 4chan, to proactively take sites down on Wednesday until system administrators could implement fixes.
Researchers utilized an OpenAI model to help identify one of the vulnerabilities, enabling PHP developers to formulate a corrective patch. OpenAI highlighted the milestone in a Wednesday blog post, noting that the breakthrough proves artificial intelligence can uncover security flaws with internet-scale impact. However, the company also acknowledged the dual-use nature of the technology, warning that the same capabilities could allow malicious actors to rapidly develop offensive tools and automated exploits.
Prior to this discovery, many cybersecurity researchers viewed AI-generated vulnerability reports with skepticism, frequently dismissing them as minor bugs or false alarms. The PHP findings are expected to force a reassessment across the cybersecurity community regarding the accelerating capabilities of automated threat analysis.
If successfully exploited, the two vulnerabilities would allow malicious hackers to gain control of vulnerable web servers without requiring a password or any other authentication credentials. Because PHP powers a vast array of internet applications, unauthorized access could enable attackers to compromise entire websites, steal sensitive user information, and tamper with web content.
Cloud security researchers at Wiz described the findings as ranking among the most severe vulnerabilities ever discovered in PHP, and arguably in software history. While the two specific flaws had existed within the codebase for decades, researchers at Wiz noted that executing a successful exploit previously required navigating an exceptionally complex chain of steps.
This incident has drawn renewed attention to the underlying fragility of the modern internet infrastructure, which relies heavily on open-source software projects maintained largely by volunteers. Security experts note that defenders have historically depended on the time gap between when a vulnerability is introduced and when it becomes exploitable to secure systems.
Michael Leland, field CTO at Island, emphasized the shifting dynamics of digital defense in an email, stating that the traditional safety margin is rapidly closing as automated tools accelerate vulnerability discovery.
Cybersecurity defenders remain on high alert for a potential wave of automated attacks targeting unpatched websites and organizations in the coming weeks as malicious actors race to leverage the newly exposed flaws.
