AI-Found PHP Flaw Puts Websites at Risk

The PHP Foundation released emergency patches on Wednesday, Oct. 21, after researchers found vulnerabilities that could let attackers take over servers and expose customer data. Website operators were told to update immediately or take affected systems offline.

Who bears the risk

PHP runs on an estimated 70% of websites and web applications, though that figure doesn’t mean every site is vulnerable. Ismael Valenzuela, vice president of labs, threat research and intelligence at cybersecurity firm Arctic Wolf, said PHP powers roughly 70% of websites where the server-side programming language is known. “The potential impact is enormous,” he said, stressing that not all websites are vulnerable and that the flaws demand “immediate attention.”

Collectively called PHP2Shell, the vulnerabilities could allow remote code execution, memory access that may expose passwords, service disruption, customer-data exposure, data theft, server takeover or website defacement. Cloudflare said the flaws could permit remote code execution, disrupt services and expose customer data.

The National Security Agency advised organizations using PHP to install updates or take affected systems offline if they couldn’t patch immediately. The FBI’s cyber division also recommended taking websites offline when operators couldn’t apply an update promptly. Governments in the United States, Europe and Asia warned organizations that rely on PHP to install updates. Britain’s National Cyber Security Center urged organizations to “take immediate action to mitigate a security issue affecting PHP.”

Some public websites became partly or fully unavailable during emergency updates. On Wednesday, the Finnish government’s website was partly available, carrying a message that government websites were fully or partially unavailable while officials resolved the issue. UPI reported that governmental bodies in France, Denmark, Finland and the Netherlands took down public-facing sites for emergency updates.

The fix and the exposure

Teams at OpenAI, Google-owned cybersecurity company Wiz and cybersecurity company Calif worked on the discovery. Wiz researchers used Google’s Gemini 4 Argon, Wiz Atlas and OpenAI’s GPT-5.6 Sol. Researchers found the bugs in late August and publicly disclosed them on Oct. 21, after PHP had a fix. OpenAI said it led a coalition of researchers, security providers and others working on PHP vulnerabilities over the previous two months.

“PHP’s maintainers led the fixes and release, with our teams and partners like Wiz, Cloudflare, and others contributing research, technical support, and coordination to prepare protections ahead of disclosure,” OpenAI said. The PHP Foundation released patches, leaving operators to install them or suspend their websites.

Public disclosure carries another risk: experts said hackers could reverse-engineer the fixes and attack systems before operators protect them. Cloudflare Chief Technology Officer Dane Knecht said some attempts to exploit the vulnerabilities were already underway. “We are seeing early attacks emerging and are updating mitigations as new vectors show up. This is a STOPGAP only. Patch as soon as PHP releases the update.”

AI firms and public infrastructure

Wiz researchers said: “With frontier AI models and the right tools, a single researcher completed in a week what previously would have taken a world-class team months of work.” They compared PHP2Shell with the Heartbleed bug from 2014, which affected an encryption technology estimated to be used by two-thirds of the Web and allowed cybercriminals to access protected data.

OpenAI called the PHP flaws “one of the most impactful security issues in recent memory.” The company said AI appeared to find the vulnerabilities before attackers did, but warned that AI could also help attackers rapidly develop offensive tools and exploits. OpenAI said the bugs were among several significant vulnerabilities it had found and was working to fix, and that it expected similar findings to increase sharply in the coming months.

The article reports no financial gain, revenue or contract figures tied to the discovery. It names technology and cybersecurity companies as research contributors, PHP maintainers as the teams that led the fixes, and website operators and public agencies as those responsible for applying patches or taking sites offline. OpenAI said governments might need a much larger role in monitoring internet infrastructure and possibly fixing vulnerabilities on other servers, according to Mother Jones. That proposal came alongside warnings that releasing a fix publicly can give attackers information about the vulnerability.