A critical security issue affecting PHP, one of the internet’s most widely used programming languages, has triggered an international response after researchers uncovered two serious vulnerabilities with the help of artificial intelligence. Government agencies, technology companies and website operators have rushed to apply security fixes, while some organisations have temporarily taken websites offline to reduce the risk of cyberattacks.
The incident highlights the growing role of AI in discovering software vulnerabilities and the challenges of securing digital infrastructure that supports millions of websites worldwide.
What Is PHP?
PHP, which stands for PHP: Hypertext Preprocessor, is an open-source programming language primarily used to build and operate websites and web applications.
It works on the server side, meaning it processes information behind the scenes before sending the finished webpage to a visitor’s browser. PHP can generate dynamic content, communicate with databases, manage user sessions and support functions such as login systems, online shopping and content management.
The language is widely used across the internet. It powers WordPress, which underpins a substantial share of websites, as well as platforms and applications built using systems such as Drupal, Joomla and Magento.
Because PHP runs on servers rather than simply appearing in the visible webpage, website owners may not always realise that their websites depend on it. This widespread use means that a serious vulnerability can have consequences far beyond a single company or platform.
What Were the Security Vulnerabilities?
Security researchers identified two critical flaws in PHP that could allow remote code execution on vulnerable servers.
Remote code execution is a particularly serious type of vulnerability because it can allow an attacker to execute commands on a system over the internet. Depending on the server’s configuration and the attacker’s access, this could lead to data theft, website defacement, malware installation or a wider compromise of the underlying infrastructure.
The vulnerabilities received severity scores of 9.2 out of 10 under the CVSS v4.0 system. Researchers said the underlying issues had remained undetected for more than a decade.
The potential scale of exposure was a major concern because the affected software is embedded in websites, hosting environments and other products. Organisations were therefore urged to identify vulnerable systems and apply the appropriate security updates immediately.
How Did AI Help Discover the Flaws?
Artificial intelligence played a central role in identifying the vulnerabilities.
Security researchers at Calif used an OpenAI model to discover a critical flaw and reported it to PHP maintainers. Researchers at Wiz independently identified vulnerabilities using AI-assisted security research tools and reported their findings.
AI systems can help researchers analyse large codebases, trace complex execution paths and test whether seemingly harmless coding issues can be turned into practical attacks. Tasks that might take human researchers substantial time can become faster when AI assists with code analysis and exploit development.
The discoveries were coordinated with software maintainers and security partners to help prepare fixes before the vulnerabilities were publicly disclosed.
The incident demonstrates AI’s potential as a defensive cybersecurity tool. It also highlights a serious concern: similar capabilities could help malicious actors develop attacks against unpatched systems.
Why Did Websites Go Offline Worldwide?
After the vulnerabilities became public, cybersecurity agencies advised organisations to update affected PHP installations as quickly as possible. Where immediate remediation was not feasible, some agencies recommended taking exposed systems offline until they could be secured.
Government websites and other digital services in parts of Europe were among those affected by precautionary shutdowns. Organisations associated with public administration, healthcare and online information services also reported taking systems offline or restricting access while addressing the risks.
The urgency was driven by the possibility that attackers could exploit vulnerable servers before operators completed their updates.
For organisations running large technology environments, the challenge extends beyond installing a patch. Security teams must identify every affected PHP installation, including those embedded in older applications, third-party products and hosting services.
Why Small Businesses and WordPress Websites Should Pay Attention
Large organisations often have dedicated security teams that can inventory systems, test patches and deploy updates quickly. Smaller businesses may have fewer technical resources and may not know which software versions their websites use.
This is particularly relevant for WordPress websites, online stores and business portals hosted on shared servers.
Website owners should not assume that updating WordPress plugins or themes automatically updates the PHP version running on the server. PHP updates are often handled separately by the hosting provider or server administrator.
Businesses should confirm which PHP version their environment uses, follow official security guidance, and check with their hosting provider if they cannot manage the server directly. Older PHP versions may require a supported upgrade path rather than a simple update.
What Organisations Should Do Next
Cybersecurity agencies have recommended a coordinated response focused on identifying vulnerable systems, applying security fixes and monitoring for suspicious activity.
Key steps include:
Identify exposure: Determine which servers, websites and applications use affected PHP versions.
Apply security updates: Install the relevant official patches or upgrade to a supported release.
Contact hosting providers: Confirm that server-side PHP installations and bundled products have been secured.
Monitor for attacks: Review logs and security alerts for suspicious activity, unauthorised changes or signs of compromise.
Check recovery plans: Ensure backups are available and that incident response procedures can be activated if necessary.
Applying a patch is essential, but it does not prove that a system was never compromised. Organisations should investigate potential signs of earlier exploitation where appropriate.
The Bigger Lesson: AI Is Changing Cybersecurity
The PHP incident illustrates a changing cybersecurity landscape in which AI can help defenders uncover weaknesses at a scale and speed that were previously difficult to achieve.
However, faster discovery also places greater pressure on software maintainers, hosting companies and website operators to coordinate fixes and deploy them before attackers exploit the same weaknesses.
The effectiveness of this response depends not only on finding vulnerabilities but also on maintaining software, communicating risks clearly and ensuring that security updates reach systems of every size.
Conclusion
PHP’s widespread use turned two critical vulnerabilities into a global cybersecurity concern. AI-assisted research helped uncover the flaws, while the resulting response demonstrated how quickly software weaknesses can affect governments, businesses and online services.
For website owners and technology teams, the priority is to identify affected systems, apply official fixes and monitor for possible compromise. As AI continues to reshape cybersecurity, rapid patching and proactive defense will become increasingly important to protecting the infrastructure that powers the internet.
