Researchers have disclosed two serious security vulnerabilities in a programming language that powers much of the internet, known as PHP. A race is now on to patch up the flaws in millions of affected websites, software packages and applications before criminal hackers get a chance to exploit them.
Governments, banks, airlines and a host of other businesses across the world took websites offline temporarily as they worked on fixes. There were already signs that hackers were trying to find ways to take advantage of the weaknesses.
The vulnerabilities have existed for years but were not discovered until researchers uncovered them recently with the help of powerful new artificial intelligence tools, which are changing the speed with which both cybersecurity researchers and hackers are able to identify weak spots in commonly used systems.
What is PHP?
PHP underpins as much as 70% of the internet, according to cybersecurity company Wiz. It works behind the scenes on servers to determine how millions of websites behave.
It was created in 1994 by Danish-Canadian programmer Rasmus Lerdorf. The term was originally an abbreviation of “Personal Home Page” and Lerdorf used it to track visitors to his own website. Later, the underlying code was rewritten by two Israeli programmers and PHP was transformed and rereleased as a broader programming language known as “PHP: Hypertext Preprocessor.”
It now powers many of the most popular management systems, such as WordPress, Drupal, and Joomla, that allow users to create, organize and publish digital content. It’s also present “under the hood” of widely used software packages, even though the software may not advertise that it is using it, according to cybersecurity firm Huntress.
What are the security issues affecting PHP?
The flaws identified by researchers can make a PHP server mishandle its working memory, potentially letting an attacker read sensitive data or run commands on the server. That might allow hackers to steal data or seize control of websites.
The developers responsible for maintaining PHP said on Oct. 21 that they released software updates to patch up the issues and urged users to adopt the changes immediately.
Did AI play a role here?
Wiz said it discovered the vulnerabilities with the help of several AI tools including Wiz Atlas, Gemini 4 Argon and OpenAI Inc.’s GPT-5.6 Sol. It said Gemini 4 Argon in particular was “invaluable” in finding the vulnerability. Wiz and the Gemini AI platforms are both owned by Google parent Alphabet Inc.
According to a report from Wiz, the PHP vulnerabilities had existed undetected for more than a decade, but the AI tools helped to identify a quick fix.
“With frontier AI models and the right tools, a single researcher completed in a week what previously would have taken a world-class team months of work,” it said.
Wiz collaborated with OpenAI and cybersecurity firm Calif on the effort. According to OpenAI, Calif separately discovered the issues with PHP as part of an initiative called Patch the Planet, which uses AI to find flaws in popular software and issue fixes for them.
OpenAI described the PHP vulnerabilities as perhaps one of the most impactful cybersecurity issues in recent memory. “It highlights how AI can uncover security flaws with internet-scale impact, but the same capabilities can also help attackers rapidly develop offensive tools and exploits,” it said.
What does the incident mean for the wider internet?
Because PHP is used so widely, entities in multiple countries and industries could potentially be affected. Any website or software running the affected version of PHP that fails to implement the security patch fast enough could potentially be targeted by hackers and experience a data breach or disruption. As of Oct. 22, cybersecurity experts said they were already seeing evidence of active intrusion attempts.
E-commerce and cloud computing giant Amazon.com Inc. said it detected a PHP exploit attempt on a “honeypot” system — set up to deliberately lure hackers so it can monitor attempted intrusions — on Oct. 17. It later saw more attempts. In a report published on Oct. 21, it said it was unclear whether the attempts would have succeeded against real systems. Amazon said the activity was conducted by an unknown “threat actor” that had somehow obtained information about the vulnerabilities prior to the public release of details about them.
Amazon later said the vulnerabilities were being “broadly exploited” by hackers. It did not provide information on any hacking victims.
“There is a real possibility that vulnerable systems could already have been compromised, including the creation of backdoors,” said Matt Hull, vice president of Cyber Intelligence and Response at NCC Group. “The potential impact is serious.”
