AI Uncovers Critical PHP Vulnerabilities Exposing 70% of Global Websites to Server Takeover
16 Sources
[1]
NSA warns on 'critical' cyber vulnerabilities detected using AI
Researchers used OpenAI and Google models to find severe faults in software used on majority of websites around the world The US National Security Agency on Wednesday warned vulnerabilities in a programming language that underpins the internet, discovered using AI tools, had left websites around
[2]
A.I. Discovered a Critical Security Flaw Underpinning Websites
Security researchers using OpenAI's advanced artificial intelligence models unearthed major bugs in a piece of software used widely across the internet, setting off fears around the world about significant disruptions for consumers and businesses. The Trump administration and some governments in
[3]
The AI-Hacking Apocalypse Began Last Night
Websites across the internet are going dark to protect themselves against a newly discovered vulnerability. The internet could be on the verge of a total meltdown. Yesterday, someone posted to a public forum that two major security flaws had been found in a programming language that undergirds the
[4]
PHP2Shell: AI found two critical flaws in 70% of websites
PHP shipped emergency patches for two critical PHP2Shell flaws that allow unauthenticated code execution. The twist: researchers found them with OpenAI and Google AI models, days before the fix was due. PHP shipped emergency security updates on Wednesday. They fix two critical flaws that let an
[5]
OpenAI Wants to 'Patch the Planet' (With Its Own AI)
Modern AI models have prodigious coding capabilities -- whether that poses a greater advantage for legitimate cyberdefenders or for malicious hackers is an open question. Either way, AI companies are thriving. The cybersecurity sector has been in crisis mode in recent months as the spread of new
[6]
Websites scramble to fix software flaw that could put much of internet at risk
AI-assisted research uncovered a critical flaw in software used by as much as 70 percent of websites, raising fears that hackers could rapidly exploit it. A programming language used in as much as 70 percent of websites on the internet has a critical security issue that could allow attackers to
[7]
OpenAI helped find the PHP flaws now shaking the internet
OpenAI says its AI models helped uncover the critical PHP security flaws that have websites across the internet scrambling. In a blog post on Wednesday, the company said it had spent the past two months leading a coalition of PHP maintainers, security researchers, and security companies to deal
[8]
AI uncovers massive flaw in web's foundational code
Why it matters: The bugs, which researchers found partly with an OpenAI model, proves AI can uncover critical flaws humans missed for decades -- raising the stakes for defenders racing to fix vulnerabilities before attackers can exploit them at machine speed. What's happening: There are two
[9]
PHP releases patches for two critical remote code flaws found with AI
Wiz said every PHP version released in the past decade is affected by at least one flaw, and that PHP powers 70% of websites PHP released security updates on Wednesday that fix two critical vulnerabilities capable of allowing unauthenticated remote code execution, flaws that researchers found with
[10]
AI helped discover the PHP vulnerability that could take down 70% of the Internet. Now the race is on to patch it before AI-powered hackers attack | Fortune
Increasingly powerful AI tools are at the center of a new war between those who want to use them to supercharge cyberattacks, and the defenders who are harnessing the same tools to fend them off. Today, the defenders are hoping they got a leg up in identifying a critical issue that stands to take
[11]
Frontier OpenAI Model Exposes Stunning Exploit That Leaves Millions of Web Servers Open to Attack
Security researchers using an OpenAI model have uncovered two stunning security flaws in PHP, the software that underpins nearly 70 percent of all websites on the internet. The flaws are so catastrophic that all websites using PHP -- all untold millions of them -- are advised to immediately take
[12]
Who Found the PHP Bug That Made Governments Unplug Their Websites? ChatGPT, Of Course
OpenAI says its models found PHP2Shell and led a two-month coalition to fix it. It's the same AI that broke into Hugging Face and an Australian government portal this year. In brief * OpenAI President Greg Brockman said the company led a two-month coalition to fix PHP2Shell, found with its models
[13]
Some Websites Go Dark as Operators Address an AI-Detected Flaw in a Web Programming Language
The FBI's cyber division warned Wednesday about the discovery of two "critical vulnerabilities" in PHP, a widely used programming language that powers many websites and web applications The FBI and the National Security Agency warned Wednesday about the discovery of two "critical vulnerabilities"
[14]
NSA warns organizations to patch security flaws identified by AI
The National Security Agency (NSA) warned organizations Wednesday to immediately patch a pair of security flaws or take their systems offline, after artificial intelligence discovered vulnerabilities in a key programming language. "Effective Immediately, all organizations using PHP for their
[15]
Critical Flaw Found By AI Puts 70% Of World's Websites At Risk
A critical vulnerability in PHP, an open-source programming language that's used in around 70% of all websites, forced prominent sites to go dark Wednesday as operators scrambled to patch their systems. The security issue was first discovered two months ago by Calif, an AI security firm. The
[16]
OpenAI Mobilizes Tech Firms to Fix Widespread Web Vulnerability | PYMNTS.com
The targets of this effort were critical vulnerabilities in PHP, an open-source programming language that is used to run websites and web applications, according to the post. The vulnerabilities were discovered and reported independently by Calif and Wiz, and then PHP's maintainers, supported by
Share
Copy Link
AI models from OpenAI and Google discovered two critical security flaws in PHP programming language that had remained hidden for over a decade. The vulnerabilities, dubbed PHP2Shell, affect an estimated 70% of websites worldwide and allow unauthenticated attackers to execute code and seize control of servers. The National Security Agency issued urgent warnings as governments scrambled to patch systems or take them offline.
AI Models Detect Decade-Old Critical Security Flaws in PHP Programming Language
Security researchers using OpenAI GPT models and Google's AI systems discovered two critical security flaws in PHP, a programming language that powers an estimated 70% of all websites globally
1
2
. The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, each rated 9.2 on the CVSS v4 scale, had existed undetected for more than a decade before AI in cybersecurity tools identified them4
. Security firm Calif found the first flaw in August using OpenAI's GPT-5.6 Sol model during an audit funded through OpenAI's Patch the Planet initiative, while Google-owned Wiz independently discovered the same vulnerabilities weeks later using Wiz Atlas, Google's Gemini 4 Argon and GPT-5.6 Sol4
.
Source: The Next Web
National Security Agency Issues Urgent Warnings on Server Takeover Risk
The National Security Agency, along with UK authorities and the EU's CERT-EU, issued urgent warnings Wednesday advising all organizations using PHP to immediately update their systems or take them offline
1
2
. The NSA emphasized that these PHP vulnerabilities often provide direct access to a server's file system or database, and recommended organizations take systems offline if immediate patching wasn't feasible1
. The UK's National Cyber Security Centre warned that the flaws could allow hackers to take control of website servers without needing passwords or login credentials1
. Japan's Prime Minister Sanae Takaichi urged immediate action, stating on social media that temporarily suspending websites could be an effective risk reduction measure if patches couldn't be applied promptly2
.Emergency Security Patches Released as Websites Go Dark Across Europe
PHP developers released emergency security patches on Wednesday morning, including versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, to address the memory-safety flaws
4
. The release came earlier than scheduled after details leaked in a post to Hacker News, forcing PHP to bring the fix forward from its planned 14:00 UTC announcement4
. Government, hospital, and school websites across Europe went dark to protect themselves, including the Finnish health agency, Port of Rotterdam, Paris police force, and 4Chan3
. The bookmarking service Pinboard, GrapheneOS forum, and streaming tool OBS pulled parts of their sites down, while Laravel halted its Cloud deployments to rebuild on patched images4
. Cloudflare activated web application firewall rules for all customers, including free accounts, at 03:02 UTC—approximately nine hours before official disclosure—and monitored attackers mutating their payloads against the rules4
.
Source: NYT
Unauthenticated Code Execution Threatens Vulnerabilities in 70% of Websites
The PHP2Shell flaws allow unauthenticated attackers to execute code on servers running the PHP programming language, with the highest risk for sites running Apache with mod_php, where an unauthenticated request can trigger the vulnerability before any application code runs
4
. PHP's widespread presence stems largely from WordPress, the most widely used website-building platform, which is written primarily in PHP and relies on it to function1
. The flaws affected PHP versions 5.4 and later, spanning more than a decade of releases4
. Volker Dusch, a security engineer at the nonprofit PHP Foundation, called it the most severe issue PHP had faced in more than a decade, comparing it to Heartbleed, the 2014 bug that forced a global patching race4
. Wiz compared the critical security flaws to both Heartbleed and Log4Shell4
.Related Stories
Dual Role of AI Highlights Defender's Window and Attacker Capabilities
OpenAI characterized the discovery as evidence that AI discovered security flaw capabilities can identify internet-scale vulnerabilities before criminals exploit them, calling this a "Defender's Window"
4
. "Given the severity of these flaws and PHP's widespread use, we consider this one of the most impactful security issues in recent memory," OpenAI stated, adding that it highlights how AI can uncover security flaws with internet-scale impact while also helping attackers rapidly develop offensive tools and exploits1
2
. Calif offered a more measured perspective, noting that knowing PHP's history mattered more than the model itself and that "no model is simply capable of unearthing 'all bugs' with simple prompts"4
. The cybersecurity crisis has intensified as the rate of software vulnerabilities identified per month has doubled over the past year, while the time hackers need to exploit those vulnerabilities has fallen from weeks to hours3
.
Source: Mashable
OpenAI Launches Patch the Planet Initiative with $1 Billion Commitment
Following the PHP2Shell disclosure, OpenAI announced its Patch the Planet framework aimed at fostering global cooperation to find and fix vulnerabilities lurking in old software
5
. The company committed $1 billion to subsidize access to Daybreak, its cybersecurity auditing platform, for organizations with limited security resources protecting essential services5
. OpenAI stated that PHP security issues were just two "among several significant vulnerabilities" it has already found, expecting "similar findings to increase sharply in the coming months"5
. The initiative invites third-party cyber professionals to review the approach, challenge assumptions, and identify gaps in a crowd-sourced mission to scour the internet for hidden security flaws before malicious actors discover them5
. Recent widespread attacks on South Korean and Japanese websites were reportedly executed by a single Chinese cybercriminal using AI to target more than 1,000 websites, demonstrating how attackers are rapidly adopting these capabilities3
.References
Summarized by
Navi
[3]
[4]
Related Stories
Anthropic Mythos evolves faster than expected, now creates working exploits from vulnerabilities
13 May 2026•Technology
AI in cybersecurity sparks new cyber arms race as vulnerability discovery outpaces patching
16 Jul 2026•Technology
Anthropic Mythos discovers 271 software vulnerabilities in Firefox 150 before release
22 Apr 2026•Technology
Recent Highlights
1
OpenAI AI Models Hacked Crypto Wallet, Breached Government Sites in Unauthorized Activities
Technology
2
Amazon Bee Unveils Two Personal AI Devices Starting at $75 with Real-Time Conversation Tracking
Technology
3
China Proposes Export Controls on 23 AI Technologies Amid US-China Rivalry
Policy and Regulation
Recent Highlights
Today's Top Stories
Don’t drown in AI news. We cut through the noise - filtering, ranking and summarizing the most important AI news, breakthroughs and research daily. Follow topics that matter to you and stay ahead.
