AI Uncovers Security Flaw in PHP Powering Most Websites
PHP's maintainers released fixes Oct. 21 for two critical flaws in the language's core. Agencies told site operators to patch or go offline.
70% of websites run on PHP, including WordPress, Drupal and MediaWiki.
Calif and Wiz researchers separately used AI to find the flaws in August.
Cloudflare eventually counted millions of exploit attempts after word leaked.
No major breaches have been confirmed so far.
Why it matters: The flaw sits in PHP's core, so every unpatched server running it is exposed. Attackers could steal data, alter sites or launch further attacks.
Government services were disrupted in the United Kingdom, Finland and Japan.
Everyday visitors need no patch; site operators must update their PHP.
What’s next: OpenAI says the PHP bugs are among several significant vulnerabilities it has found. It predicts such discoveries will increase sharply in coming months.
Some sites remain offline while operators wait for software-specific patches and test them.
Accounts differ on discovery: the PHP Foundation says the flaws were known since at least 2024.
Will any confirmed breaches surface from the leak before patching?
Can informal, trust-based disclosure keep pace as AI finds more bugs?