AI uncovers critical PHP vulnerabilities triggering global cyber alerts

AI-driven discovery of PHP vulnerabilities

Researchers at cyber-security firms Wiz and Calif used advanced AI tools to identify two critical vulnerabilities in PHP, a programming language that powers approximately 70% of the world’s websites. The flaws, dubbed "php2shell," affect versions of PHP released over the past decade and could allow attackers to take control of web servers without authentication, potentially leading to data theft.

The vulnerabilities were described by cyber-security firm Wiz as the "most severe" ever detected using AI. OpenAI, which assisted in the discovery, referred to the issue as "one of the most impactful security issues in recent memory." The PHP Foundation released emergency patches to address the flaws, but experts warn that poorly maintained websites, particularly those run by smaller organisations with limited security resources, remain at risk.

Global response and disruptions

Governments and cyber-security agencies worldwide responded swiftly to the discovery. The US National Security Agency, the UK’s National Cyber Security Centre, and counterparts in the EU, Australia, and Japan urged organisations to apply patches immediately or take systems offline if updates could not be applied swiftly. The UK agency specifically advised checking for "backdoors installed by an attacker."

The alert led to widespread disruptions, with organisations such as Wikimedia, the BBC, the Finnish government, Edinburgh council, and the Netherlands’ cyber-security agency temporarily shutting down websites as a precaution. Japanese Prime Minister Sanae Takaichi publicly urged organisations to verify if their websites relied on PHP and to take necessary action.

Cloudflare reported "thousands" of exploitation attempts targeting the vulnerabilities before their public disclosure. Amazon also confirmed it had been targeted in multiple attacks days prior to the announcement.

AI’s dual role in cyber security

The discovery highlights AI’s growing role in cyber security, both as a tool for identifying vulnerabilities and as a potential aid for attackers. AI tools can analyse code and detect flaws faster than humans or traditional systems, but they can also accelerate the development of exploits by malicious actors.

Ryan Ko, a researcher at the University of Queensland’s Cyber Research Centre, noted that while AI can uncover critical flaws, it may also enable attackers to exploit them more efficiently. Ethical hacker Ken Munro added that the incident underscores long-standing issues in software development, where functionality has often been prioritised over security.

AI’s expanding role in technology and security

The use of AI to uncover PHP vulnerabilities aligns with broader trends in AI-driven cyber security. Earlier reporting by Lazyfounder highlighted OpenAI’s expansion into advertising and its partnerships with major cloud providers like Google Cloud, where its models are now available alongside competitors such as Gemini and Claude. These developments reflect AI’s increasing integration into enterprise and security workflows, offering both opportunities and risks for organisations.

What this means

Lazyfounder analysis — our interpretation, not reported fact.

This incident serves as a wake-up call for organisations relying on legacy software like PHP. The vulnerabilities exposed demonstrate how quickly AI can identify—and potentially exploit—critical flaws in widely used infrastructure. For founders and operators, the urgency of patching and maintaining systems is clearer than ever. Smaller organisations, in particular, may lack the resources to respond swiftly, making them more vulnerable to attacks. The swift global response also signals that cyber-security agencies are increasingly treating such discoveries as high-priority threats, which could lead to stricter regulations or expectations for businesses operating online.

Related on Lazyfounder

• OpenAI
• More technology news
• OpenAI partners with Google Cloud to bring GPT-6 models and Codex to Model Garden
• Google Cloud becomes first major provider to offer OpenAI, Gemini, and Claude models