Security researchers using frontier AI models found two critical vulnerabilities in PHP that had gone undetected for more than a decade, and the fix shipped Wednesday afternoon.
The big picture: PHP quietly runs WordPress, Drupal, Joomla and Magento, plus shared hosting platforms and control panels, so a flaw in it reaches far past the sites that advertise using it. Cyber-security firm Wiz estimates roughly 70% of the internet is affected.
- "Given the severity of these flaws and PHP's widespread use, we consider this one of the most impactful security issues in recent memory," OpenAI wrote in its disclosure post.
The backstory: The bugs sat undiscovered for over a decade. The firm Calif identified one using GPT-5.6 Sol under OpenAI's Patch the Planet program, and Wiz independently found and reported both. A few weeks of work with the tools surfaced them by August.
- PHP Foundation had planned to disclose later this month alongside a complete patch, until details leaked on social media Tuesday and forced the announcement out early.
Zoom in: Finland temporarily shut down the government's public web services, the Netherlands' cyber-security agency took its own website offline, and the Wikimedia Foundation pulled systems as a precaution, breaking parts of Wikipedia for some users.
- The US National Security Agency told organisations to take systems offline if they cannot update in time, writing that the flaws "often provide a direct path to the server's file system or database".
Yes, but: Cloudflare chief technology officer Dane Knecht said the company is seeing early attacks emerging and is updating mitigations as new vectors show up. CERT-EU said the risk scores indicate potential for unauthenticated remote code execution.
Why it matters: The same capability that found these bugs can help attackers build exploits fast, which is why OpenAI committed $1 billion in subsidised model access for defenders with limited resources. Anyone running a PHP site should apply the update today.
