AI-Discovered PHP Flaws Trigger Global Website Shutdowns and Patch Rush

Key points

• PHP maintainers released urgent patches for two critical bugs on Wednesday morning after an initial warning on Tuesday evening.
• The vulnerabilities, rated 9.2 out of 10, allow unauthenticated remote code execution on unpatched systems.
• OpenAI confirmed that researchers at Calif discovered the bugs two months prior via its 'Patch the Planet' program.
• Governments in the EU, US, UK, Japan, and others issued urgent warnings, with some taking websites offline before patches were available.
• Cloudflare reported seeing active attacks, while watchTowr noted proof-of-concept tools were being generated with AI assistance.
• Only PHP versions 8.2 and newer receive patches; older versions, which constitute roughly half of all PHP sites, remain vulnerable.

Background

This incident follows a broader trend of AI-driven security discoveries, as noted in recent coverage of AI safety concerns and previous web vulnerabilities. The current event highlights the fragility of open-source infrastructure, where flaws existing for decades can be rapidly weaponized by AI tools. Previous archive entries indicate growing public and political focus on AI risks, with 71% of voters supporting stricter AI guardrails, reflecting the heightened scrutiny on AI's role in both discovering and exploiting security flaws.

How outlets are covering it

The Record emphasizes the immediate operational impact, noting hundreds of websites went offline and that Cloudflare is already seeing attacks. Axios highlights the strategic significance, framing this as a pivotal moment where AI uncovers critical flaws humans missed, forcing the cybersecurity community to reckon with AI threats. The National Cyber Security Centre (NCSC) issued a critical security alert, though its detailed content was obscured by cookie consent prompts in the provided source. OpenAI defended its role, stating the weaknesses already existed and AI helped find them, while acknowledging AI can also aid attackers. Security experts like Joviane Jardim from Detectify warn that the real risk lies in forgotten, unpatched systems, as AI allows attackers to build exploits in under an hour.

Why it matters

The PHP vulnerabilities expose the deep reliance of the internet on aging, open-source software. With AI enabling rapid exploit development, the traditional buffer between vulnerability discovery and exploitation is vanishing. This event underscores the urgent need for organizations to identify and patch all PHP instances, as unpatched systems remain highly vulnerable to automated attacks. The incident also raises broader questions about the dual-use nature of AI in cybersecurity, where the same tools that find flaws can also weaponize them.

What to watch

Security teams are prioritizing the patching of internet-facing PHP systems, with experts advising isolation of unpatchable systems. Cloudflare has released stopgap mitigations, and governments continue to monitor for exploitation. The next few weeks are expected to see a wave of incidents as attackers compare old and new code to find flaws. OpenAI and other companies are coordinating with infrastructure providers to deploy protections, while the cybersecurity community debates the implications of AI-driven vulnerability discovery and exploitation.