ع
Researchers at cybersecurity groups Calif and Wiz used advanced AI models to detect two vulnerabilities in PHP that had remained undetected for more than a decade despite powering the infrastructure behind Wikipedia and countless e-commerce platforms. The flaws centre on the language’s handling of memory errors which in specific conditions leave behind data that malicious actors can access to execute arbitrary code or steal information. According to a Financial Times report the US National Security Agency joined British authorities in issuing urgent warnings as some European governments took affected sites offline while patches were applied.
OpenAI whose GPT-5.6 Sol model contributed to the discovery described the findings as one of the most impactful security issues in recent memory while noting that frontier AI had located the vulnerabilities before any attackers. Wiz characterised the bugs as the most severe ever detected in the platform and worked alongside PHP developers to verify and remediate them before public disclosure. The PHP Foundation released patches after acknowledging in a blog post that signs of the problem had surfaced in 2024 but a combination of resource constraints and debate over fixes had delayed action.
A security researcher had flagged the general class of bugs decades earlier yet experts considered practical exploitation too complex because it demanded millisecond-level timing precision. Alan Woodward a computer scientist at the University of Surrey told New Scientist that AI changed the equation by enabling relentless automated testing without human fatigue ultimately deriving the exact sequences needed to weaponise the flaws. The New Scientist article noted that what once required teams of specialists labouring for extended periods could now be accomplished by setting multiple AI instances to run continuously.
PHP’s prevalence stems largely from its central role in WordPress the dominant content management system and the language underpins roughly 70 percent of all websites according to multiple industry assessments including those cited by Wiz and OpenAI. Cloudflare chief executive Matthew Prince reported via social media that his company observed thousands of exploitation attempts in the hours before the flaws were announced with the volume surging to millions shortly afterward. The rapid spike in activity prompted the White House to confirm that federal agencies were evaluating potential effects on government systems and critical infrastructure.
The discovery forms part of a growing pattern in which AI systems both identify defensive vulnerabilities and in some cases assist offensive operations. A Reuters investigation detailed how one hacker leveraged AI agents costing only a few thousand dollars to autonomously probe and compromise numerous websites with minimal human oversight. Google Threat Intelligence Group data showed that vulnerabilities uncovered by AI are more likely to enable remote code execution and carry higher risk profiles than those found through traditional methods.
OpenAI funded several audits of open-source projects specifically to surface issues that AI can now locate at scale. The collaboration with PHP maintainers Calif and Wiz ensured coordinated disclosure and patch development while the vulnerabilities were kept confidential to prevent premature exploitation. Security teams continue monitoring for follow-on attacks as organisations apply the updates across their environments.
