AI-discovered PHP flaws trigger global cybersecurity emergency, governments and companies scramble

AI-driven discovery of decade-old PHP flaws

Critical vulnerabilities in the PHP programming language, which underpins platforms like Wikipedia, WordPress, and countless online shops, were discovered by AI systems. The flaws had remained undetected for at least a decade before their identification prompted a global cybersecurity response. PHP powers a significant portion of the internet, and cybersecurity firm Wiz estimated that roughly 70% of websites may be affected by these vulnerabilities.

The PHP Foundation had planned to release details of the flaws alongside a fix later in October 2026. However, the information was leaked on social media on Tuesday, forcing organizations to act before an official patch was available.

Governments and companies respond under pressure

Governments in the UK, Finland, the Netherlands, and the US took drastic measures to mitigate risks. Finland’s government shut down its public web services, while Wikipedia and the Dutch cybersecurity agency temporarily took systems offline as a precaution. The UK’s National Cyber Security Centre (NCSC) urged organizations to apply patches immediately or take systems offline if remediation was not feasible.

Amazon, one of the companies targeted, reported multiple exploitation attempts before an embargo on the warning was lifted. The attacks on Amazon’s systems involved anonymous internet addresses attempting to exploit weaknesses in its decoy or "honeypot" systems. Amazon stated it was unclear how threat actors obtained knowledge of the vulnerabilities before the official disclosure.

AI’s dual role in cybersecurity

The incident underscores AI’s growing influence in cybersecurity, both as a tool for identifying vulnerabilities and as a potential accelerator for exploits. Anna-Maria Arabia, CEO of the Australian Council on AI Strategy, noted that as AI technology improves, such threats will become more commonplace. The timeline for exploiting vulnerabilities has compressed from months to days or even hours, driven by AI-driven discovery and dissemination.

CJ Moses, Amazon’s Security Chief, emphasized the urgency of global cooperation in responding to such threats. The US National Security Agency (NSA) warned that the PHP vulnerabilities could provide attackers with direct access to server file systems or databases, enabling data theft, service disruption, or deeper network infiltration.

What this means

Lazyfounder analysis — our interpretation, not reported fact.

For founders and operators, this incident is a stark reminder of the dual-edged nature of AI in cybersecurity. While AI can uncover critical vulnerabilities before they are exploited at scale, it also empowers threat actors to act faster than traditional patching cycles can handle. Companies relying on PHP—especially those running legacy systems or e-commerce platforms—must prioritize immediate patching and consider proactive threat monitoring. The leak of exploit details on social media also highlights the need for tighter control over vulnerability disclosures, as even well-intentioned embargoes can be bypassed.

Key takeaways

• The PHP vulnerabilities affect an estimated 70% of the internet, including platforms like Wikipedia and WordPress, making immediate patching critical for businesses using PHP-based systems.
• AI is shortening the window between vulnerability discovery and exploitation, forcing companies to adopt faster response strategies.
• Leaked details of vulnerabilities can lead to exploitation attempts within hours, as seen with Amazon, underscoring the risks of premature disclosure.
• Governments are taking aggressive measures, including shutting down public web services, to mitigate risks, signaling the severity of the threat to critical infrastructure.

Related on Lazyfounder

• Wiz
• OpenAI
• More technology news
• OpenAI reports AI agents disabled safety monitoring and lied about it