AI agents detect critical security flaws in PHP programming language

By the Editorial Team · Saturday, October 24, 2026

Two critical security vulnerabilities were discovered in PHP, prompting governments and organizations across Europe and the US to temporarily take websites offline to prevent potential exploitation. These flaws, found with the help of AI tools and affecting a majority of websites including those on WordPress, pose a severe risk of remote code execution and data theft, highlighting challenges in timely patch deployment and the need for coordinated cybersecurity responses.

Governments and organizations across Europe and the United States temporarily took websites offline this week as they responded to two critical security vulnerabilities discovered in PHP, one of the most widely used server-side programming languages on the web. The flaws, rated 9.2 out of 10 on the industry-standard CVSS v4.0 severity scale, could enable attackers to remotely execute code on affected servers without authentication, raising the risk of data theft, site defacement, and full system compromise.

PHP powers an estimated 70% of websites with identifiable programming languages, including many government portals, online shops, blogs, and news sites. It is also the foundation behind WordPress, which supports about 40% of all websites globally. The European Union’s cybersecurity response team, CERT-EU, advised organizations unable to immediately apply security patches to take vulnerable sites offline to prevent exploitation.

The vulnerabilities were first identified by researchers using artificial intelligence (AI) tools. Security firm Calif, in collaboration with OpenAI, discovered the initial flaw on August 11 employing OpenAI’s GPT-5.6 SoI model. Independently, Google-owned security firm Wiz found a second related flaw on August 24, also through AI-assisted research. Wiz described the discoveries as among the most severe vulnerabilities found in PHP’s history, noting that the underlying code weaknesses had existed for decades but only recently became demonstrably exploitable due to the complexity of the required attack chains.

The PHP Foundation released security patches and guidance for system updates promptly following the discoveries. However, experts highlighted the challenges in widespread patch deployment, especially given that many small and medium website operators rely on shared hosting and lack direct control over server updates. Wordfence, a WordPress security provider, warned that automatic updates would not address these vulnerabilities, emphasizing the need for manual intervention.

The FBI’s cyber division and cybersecurity firms such as Arctic Wolf and Cloudflare underscored the significant threat posed by the flaws, given the extensive usage of PHP and the potential impact on commercial infrastructure worldwide. Cloudflare reported early attempts to exploit the vulnerabilities, while GoDaddy, a major web hosting provider, warned of the risks including stolen data and compromised websites.

The role of AI in this incident has drawn attention to both the benefits and risks of emerging technologies in cybersecurity. While AI accelerated the detection and reporting of the vulnerabilities before malicious hackers could exploit them, experts cautioned about the paradox of rapidly uncovering security flaws that organizations may struggle to fix promptly. Industry professionals stressed the importance of balancing the speed at which AI identifies weaknesses with robust controls to manage their disclosure and mitigation safely.

This episode highlights ongoing concerns about securing widely deployed software amid rapid technological advances, and the critical need for coordinated efforts among developers, security researchers, and website operators to protect digital infrastructure.

This article was reported by synthesizing coverage from multiple independent news outlets to present a balanced, unbiased account. Read about our editorial standards. Spotted an error? Let us know.