Governments and businesses across the world are racing to secure their digital infrastructure after artificial intelligence helped researchers uncover critical vulnerabilities in PHP, a programming language estimated to power about 70 per cent of the world’s websites.
The flaws, collectively referred to as PHP2Shell, prompted temporary shutdowns of websites and online services as organisations moved to install security updates and limit potential exposure.
The United States National Security Agency and Europe’s cybersecurity agency urged organisations to take immediate action to address the vulnerabilities, which could allow attackers to execute malicious code remotely, disrupt services and potentially expose sensitive information.
The weaknesses had existed in PHP software for about a decade but were only publicly disclosed on Wednesday, October 21, after researchers identified the problem and a security patch became available.
Research teams at OpenAI, Google-owned cybersecurity firm Wiz and other security specialists used advanced AI tools to analyse the underlying weaknesses and develop techniques for exploiting them.
The discovery has raised fresh concerns about how artificial intelligence is changing cybersecurity, particularly its ability to help researchers identify software vulnerabilities that might otherwise remain undetected for years.
PHP is widely used to build and operate websites, making the vulnerabilities potentially significant for organisations across industries, including banking, e-commerce, travel, publishing and government services.
The PHP Foundation, which supports the programming language, released a patch and urged website operators to update affected systems.
Cloudflare, a web infrastructure and cybersecurity provider involved in the response, said its network had observed millions of attempts to exploit the vulnerabilities within a few days of their disclosure.
The flaws relate to how PHP handles computer memory when certain website requests terminate unexpectedly. Under specific conditions, data may remain in memory and become accessible or vulnerable to corruption.
If successfully exploited, the weaknesses could allow attackers to interfere with running systems, execute unauthorised code or gain access to sensitive information, depending on the affected system and its configuration.
The potential exposure is significant because PHP supports a large share of the web. However, the existence of the vulnerabilities does not mean that 70 per cent of websites have been compromised. Actual risk depends on whether a website runs affected software, its configuration and whether the relevant conditions for exploitation are present.
Nigel Green, chief executive of financial advisory firm deVere Group, warned that the widespread use of PHP could put a broad range of online services at risk if operators failed to apply the necessary fixes.
The discovery is drawing attention to AI’s growing ability to assist cybersecurity researchers in finding weaknesses that have resisted conventional analysis.
According to Wiz, the underlying flaws were discovered in late August, but details were withheld until the PHP Foundation had developed a fix.
Researchers used AI systems to analyse the software, adapt techniques for exploiting the weaknesses and evaluate the results.
Wiz said the work demonstrated how advanced AI models, when combined with specialised tools and human expertise, could significantly shorten the time needed to identify and investigate complex vulnerabilities.
The research involved Google’s Gemini 4 Argon, Wiz Atlas and OpenAI’s GPT-5.6 Sol, according to the report.
Wiz described the episode as an important turning point for cybersecurity, arguing that AI had made it practical to investigate weaknesses that had remained hidden in PHP’s codebase for more than a decade.
The development has a dual implication. The same technology that helps defenders identify flaws before criminals can exploit them may also enable malicious actors to discover weaknesses and develop attacks more quickly.
Patrick Fussell, IBM’s global head of adversary simulation, said the speed at which vulnerabilities are being discovered has increased substantially.
However, he cautioned against treating the flaw as a simple, universally effective method for taking over servers. Exploitation still depends on several technical conditions, which may not be present in every affected environment.
