Emergency PHP Patches Deployed After AI-Discovered Flaws Threaten Global Web

Key points

• PHP released emergency patches for versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12 to fix two critical remote code execution flaws.
• The vulnerabilities, discovered by security firms Calif and Wiz with the help of AI tools, allow attackers to read sensitive memory and execute code without authentication.
• The patch release was moved up from its scheduled time after details leaked on Hacker News, with Cloudflare reporting early attacks emerging before the official disclosure.
• Government agencies in the UK, EU, and US advised organizations to take unpatched systems offline immediately, as no configuration changes offer complete mitigation.
• The flaws affect all PHP installations from version 5.4 (2004) onward, impacting a vast portion of the internet, including platforms like WordPress and Magento.

Background

This incident follows a pattern of AI-assisted vulnerability discovery in web software, similar to the mass-exploited WordPress bugs reported in July 2026. PHP, a foundational scripting language for web development, has been in use since the 1990s and remains critical to global internet infrastructure. The current crisis highlights the growing reliance on AI tools for both offensive and defensive cybersecurity, with researchers using models like GPT-5.6 Sol and Gemini 4 Argon to identify flaws in widely used software.

How outlets are covering it

While all sources agree on the critical nature of the flaws, they differ on the role of AI in their discovery. OpenAI framed the findings as proof of a 'Defender’s Window,' arguing that AI can catch internet-scale flaws before criminals do, and committed $1 billion to its cyber program. In contrast, security firm Calif took a more measured stance, stating that generally available models and knowledge of PHP’s history mattered more than specialized tooling, noting that no model can simply find 'all bugs' with simple prompts. Wired emphasized the immediate danger, quoting security consultant Lukasz Olejnik, who warned of 'wormable malware' and compared the impact to critical infrastructure. The Next Web highlighted the speed of the response, noting that Cloudflare activated firewall rules nine hours before the official disclosure. Some outlets, like Ars Technica, noted that the vulnerabilities were compared to both Heartbleed and Log4Shell due to their potential for widespread exploitation.

Why it matters

The vulnerabilities pose a severe risk to global internet infrastructure, as PHP powers a significant portion of the web, including government sites, e-commerce platforms, and content management systems. The speed of exploitation, with attackers potentially launching mass attacks within minutes of disclosure, underscores the need for immediate patching. The incident also highlights the evolving role of AI in cybersecurity, with both defenders and attackers leveraging AI tools to identify and exploit vulnerabilities at scale. Failure to patch could lead to widespread compromise of sensitive data, including passwords and API keys, and could result in large-scale malware propagation.

What to watch

Organizations are urged to immediately update their PHP installations to the patched versions or take systems offline if patching is not feasible. Security teams should monitor for signs of exploitation, isolate compromised systems, and report incidents to local authorities. The PHP Foundation has provided backported fixes for unsupported versions 7.4, 8.0, and 8.1, but emphasizes that updating is the only safe choice. As AI-driven vulnerability discovery becomes more common, expect similar findings to increase in the coming months, with OpenAI predicting a sharp rise in serious vulnerabilities identified through its initiatives.