AI uncovers major flaw in many sites’ security

By the Editorial Team · Thursday, October 22, 2026

Security researchers, aided by advanced AI models, discovered critical vulnerabilities in PHP that could allow attackers to remotely control servers and steal data, leading to urgent patch releases and emergency security measures worldwide. Due to PHP's widespread use in major platforms and the risk of hackers reverse engineering the patches, security agencies have recommended immediate mitigation actions, including temporarily taking systems offline.

Security researchers have uncovered critical vulnerabilities in PHP, a widely used open-source programming language that powers an estimated 70 percent of websites and web applications. The discovery, made with the assistance of advanced artificial intelligence (AI) models, prompted governments and organizations across the United States, Europe, and Asia to issue urgent warnings and implement emergency security measures.

The nonprofit organization responsible for maintaining PHP released patches to address the flaws on Wednesday. However, security experts cautioned that the public availability of these fixes could enable hackers to reverse engineer the updates and develop exploits targeting unpatched systems. The vulnerabilities potentially allow attackers to remotely execute code, gain control of servers, steal sensitive information, or deface websites.

Security agencies including the U.S. National Security Agency and the FBI’s cyber division recommended that organizations unable to apply the patches immediately consider taking their systems offline temporarily to mitigate risk. Some government websites in Europe reportedly went offline as a precaution.

The flaws were identified by Calif, a U.S.-based cybersecurity firm specializing in testing cutting-edge AI models for security threats. Calif used OpenAI’s GPT-5.6 Sol model along with an unreleased AI platform to detect and investigate the vulnerabilities within days. OpenAI confirmed Calif’s use of its technology for the discovery and noted that Google-owned cybersecurity firm Wiz also independently reported the issues.

Experts emphasized that the combination of PHP’s widespread use and the ease with which attackers might replicate the vulnerabilities could lead to significant and lasting impacts. Cynthia Kaiser, a former senior FBI official now at cybersecurity firm Halcyon, described the situation as an urgent patching emergency intensified by AI’s role in both discovering flaws and potentially facilitating cyberattacks.

Although PHP’s adoption has been declining, with many newer websites adopting alternative technologies less prone to such vulnerabilities, the programming language remains integral to major platforms like WordPress and Drupal. Researchers highlighted the scale of the risk given PHP’s deep integration into the internet’s infrastructure.

This discovery adds to a growing concern within the cybersecurity community about AI’s dual impact: it can enhance the identification of complex security gaps while simultaneously accelerating the development of offensive cyber tools by malicious actors.

Calif has previously used AI models to uncover other significant vulnerabilities, such as exploits affecting China’s WeChat platform and Apple’s macOS operating system, though those incidents had more contained effects compared to the PHP vulnerability disclosed this week.

As organizations rush to secure their systems, the situation underscores the challenges of maintaining internet security amid rapidly evolving threats enabled by AI technologies. The coming weeks are expected to be critical in preventing widespread exploitation of the vulnerabilities.

This article was reported by synthesizing coverage from multiple independent news outlets to present a balanced, unbiased account. Read about our editorial standards. Spotted an error? Let us know.