AI Has Uncovered a Cybersecurity Issue Affecting Websites
For more than a decade, serious security weaknesses have hidden inside one of the technologies that quietly powers much of the internet. This week, researchers discovered those flaws with the help of artificial intelligence — triggering a global cybersecurity alert. The vulnerabilities were found in PHP, a programming language used to build websites and web applications worldwide since the 1990s.
The discovery was serious enough to prompt governments and cybersecurity agencies to issue urgent warnings. Website owners have been told to install emergency security updates as quickly as possible. When that isn’t possible, some organisations have been advised to take their websites offline temporarily.
Cybersecurity company Wiz, one of the organisations that discovered the vulnerabilities, described them as the most serious flaws ever uncovered with AI.
OpenAI, whose technology was used during the research, called the discovery one of the most significant security issues in recent memory.
So, what exactly is PHP?
You may not recognise the name PHP, but you probably interact with it every day. PHP is an open-source programming language that runs behind the scenes on web servers. It was originally developed in the early 1990s to make creating dynamic websites and web applications easier.
Today, PHP still plays a major role on the internet. Platforms such as Wikipedia, WordPress, and countless online shops and other websites use it.
In simple terms, PHP helps a website retrieve information from a server, process it, and turn it into the pages visitors see in their browsers.
PHP also powers popular development tools and frameworks such as Laravel, Symfony, and Drupal. According to cybersecurity company Wiz, around 70% of websites worldwide use PHP.
The PHP Foundation, a non-profit organisation supported by companies and developers who rely on PHP, maintains the language and works to ensure it continues to be developed.
What is the security problem?
Researchers from cybersecurity companies Wiz and Calif discovered two vulnerabilities in PHP and disclosed their findings this week. The vulnerabilities, referred to as “php2shell”, affect multiple PHP versions released over the past decade.
The researchers say that, under certain conditions, an attacker could potentially exploit the flaws to gain control of a vulnerable web server and access sensitive information.
That is what makes the discovery particularly worrying: PHP is so widely used that the potential number of affected websites is enormous.
Ryan Austin, a Calif researcher involved in the discovery, described it as the most serious vulnerability he had ever found.
Wiz warned that the vulnerability could let attackers compromise servers and steal sensitive data.
And AI could make the situation even more challenging. Cybersecurity experts say attackers could use AI to identify vulnerable systems and develop exploits much faster than before.
Paul Spain, chief executive of Gorilla Cyber Security, estimated that the flaw could potentially affect millions of websites.
Jill Slay, a cybersecurity researcher at the University of Adelaide, warned that the consequences could be extremely serious if criminal groups or governments weaponised the vulnerability.
Which websites have been affected?
The discovery has already affected organisations worldwide. Some websites and online services have been taken offline as a precaution, including government portals, public-sector websites, online platforms, and forums.
Wikimedia, the organisation behind Wikipedia, temporarily took several systems offline while it assessed the situation.
Websites belonging to organisations in Finland, Edinburgh and the Netherlands were also taken offline. The University of Geneva was among the other organisations that temporarily shut down its website.
Several public-sector organisations in Scotland, including councils and health boards, have taken similar precautions.
Experts are particularly concerned about smaller organisations that may not have dedicated cybersecurity teams or the resources to respond quickly. And the problem may get worse before it gets better.
As technical details about the vulnerabilities become public, security researchers expect attackers to make increasingly serious attempts to exploit them in the coming weeks.
What happened after the discovery?
The PHP Foundation released security patches on Wednesday and urged everyone using PHP to update their systems immediately. That warning has been repeated by cybersecurity agencies around the world.
The US National Security Agency told organisations using PHP to consider taking systems offline if they could not install the necessary fixes quickly. It warned that the vulnerability could potentially provide attackers with a route into a system’s database.
The UK’s National Cyber Security Centre issued similar advice and urged organisations to check whether attackers had already installed hidden “backdoors” on affected systems.
Cybersecurity authorities in the European Union, Singapore and Australia have also issued warnings.
Japan’s Prime Minister Sanae Takaichi even urged organisations to check whether their publicly accessible websites were running PHP.
The message from authorities is fairly simple: patch vulnerable systems as soon as possible, and don’t ignore the problem.
Hackers were already trying to exploit the flaws.
The urgency increased when technology companies began reporting attempts to exploit the vulnerabilities.
Amazon said it had detected multiple attacks targeting its systems in the days before the vulnerability was publicly disclosed, although its websites continued to operate normally.
Cloudflare CEO Matthew Prince also reported a dramatic increase in attempted attacks.
According to Prince, Cloudflare saw thousands of attempts in the hours before the announcement. That number jumped to tens of thousands shortly after the vulnerability became public, then to hundreds of thousands and eventually millions.
That rapid increase shows why security researchers are concerned about publicly releasing technical details about vulnerabilities. Once attackers know exactly where the weakness is, they can move very quickly.
How did AI help find the problem?
This is perhaps the most interesting part of the story. Researchers at Wiz and Calif used advanced AI tools to analyse PHP’s code and identify security weaknesses.
Traditionally, finding vulnerabilities in huge software projects can take security researchers enormous amounts of time. Some flaws can remain hidden for years.
AI is changing that.
Salil Kanhere, a cybersecurity researcher at UNSW Sydney, explained that the underlying bugs weren’t necessarily new. What changed was the ability to find them.
That’s an important distinction. The vulnerabilities had been sitting inside software for years. AI didn’t create them — it helped researchers uncover them.
But there is a worrying downside.
The same technology that helps defenders find vulnerabilities could also help attackers discover weaknesses and build exploits much faster.
OpenAI has acknowledgedAI’ss double-edged nature, saying the incident shows both its ability to uncover security flaws and its potential to help attackers develop offensive tools.
The company has also released a tool designed to help people check whether their PHP installations are secure.
Ryan Ko, from the University of Queensland’s Cyber Research Centre, pointed out that many older software systems were designed primarily around functionality rather than security.
That’s one reason vulnerabilities can remain hidden for so long.
What does this mean for ordinary internet users?
For most people, there is probably no need to panic. These vulnerabilities affect the back-end systems that run websites, so ordinary visitors generally won’t need to do anything.
Website owners, developers, and organisations running PHP-based infrastructure need to pay the most attention. That includes many small businesses whose websites are built using WordPress.
If you own or manage a PHP-based website, make sure it runs a patched version.
If a hosting company or developer manages your website, contact them and ask whether they’ve installed the latest PHP security updates.
Updating WordPress or its plugins isn’t enough. The PHP software itself also needs patching.
If you manage your own server, you’re responsible for making sure those updates are installed.
If you can’t apply the necessary security fixes quickly, the UK’s National Cyber Security Centre recommends temporarily taking the affected website offline.
What should users watch out for?
Although website operators must do most of the work, ordinary users should still be cautious.
Keep an eye out for legitimate security announcements from websites and services you use. If a service tells you that you need to change your password because of a security incident, follow its official instructions.
At the same time, be wary of unexpected emails or messages asking you to click links, reset passwords, or provide personal information.
Major cybersecurity incidents often create opportunities for scammers and criminals to launch phishing campaigns.
The bigger lesson
The PHP incident is about more than one programming language or two newly discovered vulnerabilities.
It highlights how much of the internet still depends on software designed years—sometimes decades—ago. It also shows how dramatically AI is changing cybersecurity.
For defenders, AI can act like a powerful new set of eyes, scanning enormous amounts of code and finding problems that humans might miss.
For attackers, the same technology could make it easier to discover and exploit those weaknesses.
The result will likely be an ongoing race between those trying to secure the internet and those trying to break into it.
For now, the most important message for website owners is straightforward: check your PHP version, install the security patches, and don’t wait.