AI uncovers a flaw that could put 70% of the web at risk

Governments and cybersecurity experts have urged website operators to take vulnerable systems offline after researchers discovered serious security flaws in PHP, a programming language that powers much of the internet.

Developers released patches yesterday and urged administrators to apply them manually without delay to protect against potentially damaging cyberattacks.

PHP supports about 69% of all websites, according to W3Techs. Internet security firm Censys reported that nearly 55 million web properties were running the software as of Wednesday. Experts said they needed more time to determine how many websites had installed the fixes and whether hackers had already exploited the flaws.

What happened?
Multiple researchers independently identified the bug using AI over the summer, then joined forces to develop a patch. They released it at 10 a.m. ET on Tuesday.

Developers wrote more than 10,000 lines of code to fix the flaw.

But the release also gives potential attackers a chance to study the changes and look for additional vulnerabilities. Experts warned that successful exploitation could allow attackers to tamper with websites, run malicious code on servers, and steal data.

Cybersecurity platform Patchstack reported signs of active attacks. Cloudflare, a major website hosting provider, also said it had detected early attacks and was updating its defenses.

OpenAI said it discovered the vulnerabilities through a cybersecurity research program and alerted PHP developers before attackers could exploit them more extensively.

A PHP vulnerability that remained low on the priority list for years has taken on new significance in the age of AI. Researchers used the tech to help uncover and patch the flaw, which was once considered too complicated for hackers to exploit manually. But advanced AI models could turn that once-daunting task into one that takes hours—or potentially just seconds—increasing the pressure on organizations to secure their systems.

Experts warned that identifying the full scale of the threat could take several days.