AI is finding software flaws faster, and so are hackers: Inside the PHP scramble

Two serious security flaws have been found in PHP, a programming language used by a large part of the internet. Artificial intelligence (AI) models helped researchers discover the flaws. Governments and companies are now rushing to fix them before attackers can use them.

The flaws could let attackers send commands to affected web servers over the internet without needing a password or an account.

Since the flaws became public, organisations including Japan’s Ministry of Finance, French telecoms group Orange and Finland’s state IT services provider Valtori have taken some websites and online services offline as a safety measure. Cybersecurity companies have also reported a sharp rise in attempts to exploit the flaws.

According to Reuters, researchers at cybersecurity firm Calif worked with OpenAI to find the first flaw. They reported it to PHP developers on August 11 after discovering it with OpenAI’s GPT-5.6 Sol model. Cybersecurity firm Wiz independently found a second flaw on August 24, also using AI models.

The incident shows how AI is changing cybersecurity for both defenders and attackers. AI is helping researchers find weaknesses in widely used software that may have gone unnoticed for years. But once these weaknesses become public, attackers are moving faster than many organisations can install fixes.

How quickly did attackers move?

PHP developers released fixes on Wednesday and urged users to install them immediately. Within hours, Cloudflare and Amazon reported a sharp rise in attempts to exploit the flaws. Cloudflare chief executive Matthew Prince said the company saw thousands of attempts before the announcement. The number rose to hundreds of thousands within two hours and eventually reached millions.

Satnam Narang, a senior staff research engineer at cybersecurity firm Tenable, said the technical details published after the flaws were announced helped attackers quickly create proof-of-concept exploits. These are working examples that show how a security flaw could be used in an attack.

The PHP Foundation said it had not found any working exploits when it released the fixes. However, reports of attempts to exploit the flaws appeared soon afterward.

Tenable has given the flaws its highest rating under its Vulnerability Watch programme, calling them a “Vulnerability of Concern”. Narang said their possible impact and PHP’s widespread use made them among the most serious security flaws since Log4Shell. That 2021 flaw affected a widely used logging tool and put millions of systems around the world at risk.

If attackers use the flaws, they could steal data, change website content or take control of systems. According to Tenable, one of the flaws, CVE-2026-109619, could also expose data stored in a server’s memory.

Why are websites going offline?

Organisations are temporarily taking services offline as a safety measure while they install fixes and check their risks. According to Reuters, government websites and services run by airlines, financial institutions and other organisations were temporarily suspended across Europe and Asia.

Japan’s Ministry of Finance and National Tax Agency suspended some online services. Orange restricted access to some of its websites and applications that use PHP. Valtori blocked public government services while it installed fixes. The organisation said it was not aware of any active attacks exploiting the flaws against its services and was gradually restoring access.

These shutdowns do not necessarily mean the websites have been hacked. However, some organisations can fix the problem faster than others.

Smaller organisations may not have their own security teams and often rely on their hosting providers to install updates. Systems using older PHP versions that are no longer supported may need bigger upgrades. Applications that include PHP as part of their software may also have to wait for their vendors to provide fixes.

Why does PHP matter?

PHP is a free programming language whose source code is openly available. It runs on web servers and handles tasks that happen behind the scenes of websites. It was created in the mid-1990s to build web pages that change in response to what users do.

According to web technology tracker W3Techs, PHP is used by nearly 70% of websites whose server-side programming language is known. PHP also powers WordPress, which runs about 40% of all websites, including news sites, online shops and government websites.

Because PHP is used so widely, a single flaw in it can affect many websites at the same time. However, the actual risk to each website depends on which version of PHP it uses and whether that version is affected.