AI exposes critical PHP flaws, sparking global website shutdowns

Wiz Research used artificial intelligence models from OpenAI and Google to uncover critical vulnerabilities hidden in PHP's code for over a decade, prompting an emergency fix Wednesday that forced websites worldwide offline as developers scrambled to update their systems.

Decade-old flaws uncovered

Created in the early 1990s, PHP serves as a backbone for approximately 70 percent of global websites — from online stores to government services — and the newly discovered weaknesses could allow hackers to break into various platforms by exploiting the language's underlying architecture. Calif identified the flaws separately during an OpenAI-funded audit, while Wiz employed advanced AI models to scan for entry points that had evaded detection since the language's early development.

Global shutdowns ordered

"If you run PHP, it is imperative that you update now," the PHP Foundation warned tech departments worldwide Wednesday, triggering mass outages as organisations took services offline to apply patches. The Paris police website and a Pokemon sleep tracker were among the platforms going dark Thursday, though experts emphasized that such shutdowns represent precautionary measures rather than evidence of successful breaches.

AI weaponisation fears

OpenAI described the vulnerabilities as "one of the most impactful vulnerabilities in recent memory," noting that the discovery "marks a new phase, where AI can find security bugs with internet-scale impact." Steve Kerrison, senior lecturer in cybersecurity at James Cook University's Singapore campus, told AFP that "the moment all the information's out there, people can weaponise it very, very quickly," warning that smaller sites may remain exposed for months. Rahat Masood of the University of New South Wales emphasized that third-party PHP interfaces could leave organisations vulnerable even after patching, highlighting lingering supply chain risks.