Artificial intelligence tools have uncovered critical remote code execution vulnerabilities in PHP, a foundational programming language powering an estimated 70% of the internet. As disclosed by security firms including Wiz Research and Calif, the flaws triggered a global scramble among IT workers, resulting in patches and temporarily dark websites worldwide.
AI Discoveries Force Critical PHP Security Patches
- PHP foundation and research firms released critical patches following AI-driven discovery of long-hidden vulnerabilities.
- IT departments globally faced relentless scrambling to update underlying code, causing temporary outages across diverse platforms like the Paris police website and a Pokémon sleep tracker.
- Security experts emphasize that while the automated discovery weaponized information rapidly, active exploitation attempts remained unconfirmed as emergency patches rolled out.
AI Uncovers Decades-Old Code Flaws
The security crisis began when artificial intelligence models from US firms OpenAI and Google were deployed by Wiz Research and other groups to probe the PHP programming language. Created in the early 1990s, PHP serves as the infrastructure backbone for roughly 70% of global websites. According to Wiz Research, the AI successfully detected critical security bugs that had remained hidden within the code for more than a decade. OpenAI described the discovery as “one of the most impactful vulnerabilities in recent memory”, noting that it marks a new phase where AI can identify security flaws at internet scale.
OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites.Over the past two months, we led a coalition of maintainers, researchers,…
Separately, security firm Calif uncovered similar vulnerabilities during an OpenAI-funded audit of the PHP source code. The findings were kept under wraps while developers engineered a fix, but the dual discoveries set the stage for immediate operational chaos upon public disclosure. Steve Kerrison, senior lecturer in cybersecurity at the Singapore campus of James Cook University, told AFP that the core issue with AI-driven discovery is speed. “The trouble with tools like AI is that the moment all the information’s out there, people can weaponise it very, very quickly,” Kerrison stated.
Urgent Updates Cause Global Website Outages
Following the disclosure, the PHP Foundation issued an urgent directive to enterprise tech departments worldwide: “If you run PHP, it is imperative that you update now.” This triggered an intense, relentless scramble for front-line IT workers tasked with deploying patches across millions of servers. The emergency updates forced numerous applications and websites offline as developers worked to protect their infrastructure. Among the affected digital properties were high-profile targets including the Paris police website and a popular Pokémon sleep tracker.
Websites across the globe were hit by millions of attempts to exploit the code flaw almost immediately after details emerged, as reported by The Guardian. BBC reported that IT workers on the frontline described the emergency response as relentless, working frantically to insulate systems against potential attacks. Larger institutions, such as government agencies and major news outlets, possessed the resources to fix their infrastructure relatively quickly. However, smaller entities and legacy systems faced severe hurdles in implementing defenses before malicious actors could capitalize on the exposed code.
Assessing the Immediate Cyber Risk
Despite the high volume of automated scanning and exploit attempts following the disclosure, initial forensic evidence offered a brief window of relief. Mr. Kerrison noted that the evidence gathered by security researchers indicated that “nobody was actively performing attacks using the techniques available” immediately after the patch release. However, experts cautioned that patching alone does not guarantee absolute safety. Rahat Masood, senior lecturer in cyber security at the University of New South Wales in Sydney, warned that organizations remain unsecure if they rely solely on a single software update, emphasizing the necessity of layered defensive architectures.
Two classes extremely bad cyber vulnerabilities disclosed in the last 24 hours. The first potentially impacts everyone online. The second impacts nearly everyone running a server.tl;dr: Everyone should upgrade their OS and Browser as soon as possible. If you run a server you…
| Entity / Organization | Role in PHP Vulnerability Event | Reported Action / Impact |
|---|---|---|
| Wiz Research | Security Firm | Used AI models to uncover hidden PHP vulnerabilities. |
| PHP Foundation | Released emergency patches and issued global warnings for immediate updates. | |
| Calif | Security firm | Identified separate code flaws during an OpenAI-funded audit. |
More on Wiz Research
Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.
