AI is finding software flaws faster, and so are hackers: Inside the PHP scramble

Two critical vulnerabilities in PHP or Hypertext Preprocessor, the programming language behind a large part of the internet, have been discovered with the help of artificial intelligence (AI) models. Governments and companies are now rushing to fix them before attackers can take advantage.

The flaws could allow attackers to run commands on vulnerable web servers over the internet without needing a password or an account.

Since they were made public, organisations including Japan’s Ministry of Finance, French telecoms group Orange and Finland’s state IT services provider Valtori have taken some websites and online services offline as a precaution, and cybersecurity firms have reported a sharp rise in attempts to exploit the flaws.


According to Reuters, researchers at cybersecurity firm Calif, working with OpenAI, reported the first vulnerability to PHP developers on August 11 after discovering it with OpenAI’s GPT-5.6 Sol model. Cybersecurity firm Wiz independently found a second flaw on August 24, also with the help of AI models.

The incident shows how AI is changing cybersecurity on both sides. It is helping researchers uncover flaws in widely used software that may have gone unnoticed for years, but once those flaws become public, attackers are moving faster than many organisations can patch.

How quickly did attackers move?

PHP developers released patches on Wednesday and urged users to update immediately. Within hours, Cloudflare and Amazon reported a surge in exploitation attempts. Cloudflare chief executive Matthew Prince said they saw thousands of attempts before the announcement, which rose to hundreds of thousands within two hours and eventually into the millions.

Satnam Narang, senior staff research engineer at cybersecurity firm Tenable, said the details released after disclosure helped speed up the development of proof-of-concept exploits, which are working demonstrations of how a flaw can be used in an attack.

The PHP Foundation said it had not found any functional exploits when it released the fixes, but exploitation attempts were reported soon after.

Tenable has classified the flaws as a “Vulnerability of Concern”, its highest rating under its Vulnerability Watch programme. Narang said their potential impact and the widespread use of PHP made them among the most consequential vulnerabilities since Log4Shell, the 2021 flaw in a widely used logging tool that affected millions of systems worldwide.

If exploited, the flaws could allow attackers to steal data, change website content or take control of systems. One of them, CVE-2026-109619, could also expose data stored in a server’s memory, according to Tenable.

Why are websites going offline?

Organisations are taking services offline as a precaution while they install patches and assess their risks. According to Reuters, government portals and services run by airlines, financial institutions and other organisations were temporarily suspended across Europe and Asia.

Japan’s Ministry of Finance and National Tax Agency suspended some online services, while Orange restricted access to some of its PHP-based websites and applications. Valtori blocked public government services while it installed patches, but said it was not aware of any active exploitation affecting its services and was gradually restoring access.

These shutdowns do not necessarily mean the websites have been breached. However, not every organisation can fix the problem at the same speed.

Smaller organisations may not have dedicated security teams and often depend on hosting providers to apply updates. Systems running older, unsupported versions of PHP may need larger upgrades, and applications that bundle PHP must wait for their vendors to release fixes.

Why does PHP matter?

PHP is a free, open-source language that runs on web servers and handles the work happening behind the scenes of a website. It was created in the mid-1990s to build web pages that change based on what users do.

According to web technology tracker W3Techs, PHP runs nearly 70% of websites whose server-side programming language is known. It also powers WordPress, which runs about 40% of all websites, including news sites, online shops and government portals.

That reach is why a flaw in PHP can affect so many websites at once. The actual risk to any individual site, however, depends on which version of PHP it runs and whether that version is affected.