Security officials and major technology firms are sounding the alarm over two critical vulnerabilities discovered in PHP, the foundational programming language that powers nearly 70 percent of all websites. The discovery, facilitated in part by artificial intelligence, has exposed flaws that remained hidden from human eyes for decades, triggering a frantic race between global defenders and malicious actors.
The vulnerabilities represent one of the most significant cybersecurity developments to date involving AI-assisted research. OpenAI recently confirmed that its models played a pivotal role in helping researchers identify one of the bugs, which allowed for the development of a security patch. However, the revelation has also highlighted a dangerous new reality: the same AI capabilities used to defend the internet can be harnessed by attackers to develop offensive exploits at machine speed.
The scale of the threat is immense. Because PHP is the backbone for a vast majority of web applications, these flaws allow hackers to bypass traditional security barriers. If successfully exploited, the vulnerabilities enable attackers to take full control of web servers without requiring passwords or other credentials. This level of access could lead to mass data theft, site tampering, and the total compromise of sensitive user information.
The reaction from the hacking community was nearly instantaneous. Matthew Prince, the CEO of global security firm Cloudflare, reported a dramatic surge in malicious activity immediately following the public announcement of the flaws. According to Prince, the company observed thousands of exploit attempts in the 10 hours leading up to the announcement. This activity spiked to tens of thousands of attempts within 45 minutes of the news going public, reaching hundreds of thousands within two hours. Currently, those attempts have scaled into the millions as automated tools scan the web for unpatched servers.
Government agencies in the United States and Japan have issued urgent directives to the private sector, advising companies to apply the necessary security patches immediately. In some cases, officials have suggested that organizations should take their websites offline entirely if they cannot verify that their systems are secure, citing the extreme risk of a server-level takeover.
This sense of urgency has already impacted major online platforms. Services associated with Wikipedia and the imageboard 4chan briefly went offline earlier this week as administrators worked to patch their systems. Security researchers at the firm Wiz characterized these findings as being among the most severe vulnerabilities in the history of software, noting that while the flaws had existed for decades, proving they were exploitable previously required an exceptionally complex chain of manual steps that AI has now simplified.
The discovery shines a harsh light on the fragility of the modern internet. Much of the web’s core infrastructure relies on open-source software maintained by volunteers, often containing legacy code that has not been scrutinized by modern security tools. For years, cybersecurity experts relied on the “patch gap”—the time between the discovery of a vulnerability and the development of a functional exploit—to protect systems.
Michael Leland, field CTO at Island, noted that this traditional safety margin is rapidly disappearing. As AI reduces the technical barrier to finding and weaponizing flaws, the window for defenders to react is closing. The cybersecurity community is now bracing for a potential wave of high-profile breaches in the coming weeks as attackers continue to iterate on the newly discovered PHP bugs. For now, the focus remains on a global patching effort to secure the millions of servers that remain exposed to this AI-uncovered threat.
