A groundbreaking discovery of two critical, long-undetected security flaws in the widely used PHP programming language—made with the help of artificial intelligence—has sent governments and organizations across the globe rushing to take web services offline ahead of patching. The vulnerabilities, which have gone unspotted for more than 10 years, are being called among the most severe cyber threats to global internet infrastructure in recent memory, triggering urgent warnings from top cybersecurity agencies worldwide.
The flaws were uncovered by cybersecurity researchers at California-based security firm Calif and Wiz, who leveraged cutting-edge frontier AI technology developed by OpenAI to identify the bugs. Wiz has described the find as the most severe set of vulnerabilities ever located by AI, marking a major shift in how cybersecurity research is conducted as AI reshapes the threat and discovery landscape. In a public statement, Wiz noted that large AI models were critical to making the vulnerability detection process practical, allowing researchers to develop and test working exploits across multiple platforms in just hours. OpenAI later called the issue one of the most impactful security incidents in recent years.
PHP, a foundational server-side programming language launched for web development, powers an estimated majority of the internet’s websites, running behind popular content management systems including WordPress, Drupal, and Joomla, as well as e-commerce platforms like Magento, shared hosting services, and countless uncredited backend tools. Wiz estimates roughly 70% of all internet services rely on the language, a figure that the BBC has not independently verified. The European Union’s Computer Emergency Response Team (CERT-EU) confirmed that the vulnerabilities affect every version of PHP released from 2004’s PHP 5 onwards, stretching across nearly 20 years of iterations. While the PHP Foundation released an official security patch on Wednesday afternoon, the fix is only available for the most recent PHP versions, leaving users of outdated versions 8.1 and older with no option but to upgrade to a supported release to address the flaw.
Cybersecurity experts warn the two critical flaws enable unauthenticated remote code execution, meaning threat actors can compromise vulnerable servers without any prior access, install malware, hijack website infrastructure, or take services completely offline. Don Smith, a cybersecurity expert with Sophos’ Counter Threat Unit, told reporters that the flaws will almost immediately become a top priority for malicious hackers, noting that the biggest challenge for organizations is not just applying the patch, but mapping all instances of PHP running across their systems—many of which may go unadvertised or undetected by system administrators. “PHP can sit beneath public websites, content management systems, hosting platforms and third-party products, sometimes without even being obvious to the organisation using it,” Smith explained, adding that teams should immediately check for signs that attackers may have already exploited the unpatched flaws. Dane Knecht, chief technology officer at global internet infrastructure firm Cloudflare, confirmed that early exploit attempts have already begun emerging, with security teams working around the clock to roll out new mitigations as new attack vectors are identified.
In response to the urgent warnings from global cybersecurity agencies, dozens of public and private organizations have voluntarily taken web services offline to prevent exploitation before patches can be applied. Finland’s national government has temporarily shut down all public government web portals, while multiple Dutch government sites—including the official site of the Netherlands’ cyber security agency and the website for the Tweede Kamer, the country’s lower parliamentary house—have also been taken offline. In the United Kingdom, Edinburgh City Council’s main website is currently inaccessible, and multiple high-profile BBC program pages, including the official sites for hit shows *Doctor Who* and *The Traitors*, are also offline. The BBC has not yet confirmed that the outage is tied directly to the PHP vulnerabilities, and has requested comment from the network’s digital team. Popular art and creator platform DeviantArt also confirmed it is currently offline for emergency maintenance, though it has not publicly linked the outage to the PHP flaws.
On the government side, the White House confirmed that U.S. federal agencies are currently conducting full assessments of potential risks to government systems and national critical infrastructure, and are collaborating with leading AI labs to accelerate the patching process across affected systems. Japan’s Prime Minister Sanae Takaichi published a public post on X urging Japanese website owners to immediately check whether their public platforms run on PHP and address any vulnerabilities. Top cybersecurity agencies from the U.K.’s National Cyber Security Centre (NCSC), the EU, Japan, and Australia have all issued coordinated urgent calls for organizations running PHP to apply the patch as rapidly as possible, and to take systems offline if immediate patching is not possible.
After applying the patch, the NCSC advised organizations to maintain continuous monitoring for security updates from all third-party vendors that bundle PHP into their services and appliances, to prevent similar unaddressed flaws from being exploited in the future. The discovery also marks a turning point for AI in cybersecurity: while AI has been increasingly integrated into defensive and offensive cyber operations, this find is the first time AI has uncovered a major global vulnerability of this scale, highlighting both the transformative potential of the technology for improving internet security and the growing risk of widespread flaws in core foundational internet infrastructure.