Security researchers using artificial intelligence identified two critical vulnerabilities in PHP — the programming language that powers nearly 70% of websites on the internet. The flaws had existed for decades and, if successfully exploited, could allow attackers to take control of web servers without passwords or other credentials. After the public disclosure of the issue, the number of attack attempts surged sharply, Axios reports.

From thousands of attack attempts to millions

Matthew Prince, CEO of Cloudflare — a company that provides internet infrastructure and cybersecurity services — spoke about the scale of the threat. According to him, ten hours before the public announcement of the vulnerabilities, the company had recorded thousands of attempts to exploit them.

After the information was published, the situation changed quickly: the number of attempts reached tens of thousands within 45 minutes, hundreds of thousands within two hours, and then millions.

This trend shows how quickly information about critical vulnerabilities can turn into a tool for attacks. As soon as the information becomes publicly available, attackers begin searching for vulnerable systems and automating intrusion attempts.

Authorities in the United States, Japan, and other countries warned organizations of the need to install patches. If updating systems promptly is not possible, in some cases it is recommended to temporarily take websites offline to reduce the risk of compromise.

Why the PHP vulnerabilities are dangerous

PHP is an open-source programming language widely used to build and run websites and applications. According to W3Techs, it is used on nearly 70% of websites for which the server-side programming language is known.

The discovered flaws make it possible, in a successful attack, to achieve remote code execution on a vulnerable server. In other words, an attacker can run their own commands on it without first having to gain access to an account.

This creates a risk of website takeovers, theft of confidential data, and changes to web page content. Because PHP is so widely used, the consequences could affect many organizations and internet services.

Some website owners chose to temporarily take their resources or certain functions offline until the vulnerabilities were fixed. These included some Wikipedia services and the 4chan website.

Researchers at Wiz called these issues among the most serious vulnerabilities in the entire history of PHP and possibly of software in general. At the same time, both flaws had existed for decades, and demonstrating the possibility of exploiting them required an exceptionally complex sequence of actions.

How AI helped uncover the problem

An OpenAI model participated in the search for vulnerabilities. The company said its model helped discover one of the two issues, after which PHP researchers were able to prepare a fix.

This is an important example of the practical application of AI in cybersecurity. Previously, specialists treated automatically generated vulnerability reports with caution: many reports about discovered flaws turned out to be insignificant or outright false alarms.

However, the current case shows that AI is capable of helping identify flaws whose consequences could spread across a significant part of the internet. Such systems can analyze source code and find complex combinations of conditions that are difficult to notice during a normal review.

There is also a downside to this capability. The same tools can help attackers develop methods for exploiting vulnerabilities more quickly and automate attacks.

OpenAI emphasized that the discovery demonstrates both AI’s potential to detect critical problems and the risk of using similar capabilities for offensive purposes.

The internet depends on software that is difficult to maintain

The PHP story revealed a broader problem: the modern internet is largely built on open-source software that is often maintained by small teams or volunteers.

As AI develops, researchers will be able to find more and more flaws in such projects. But discovering a vulnerability is only the first stage. Developers need to verify the report, prepare a fix, and release an update, while website administrators need to install it on their systems.

If the number of AI-discovered flaws grows faster than maintenance teams can handle them, the burden on developers will become a serious obstacle to improving security.

In the past, defenders could count on the time gap between the discovery of a flaw and the creation of a working exploit to install a fix in time. Now that gap may shrink: AI is capable of accelerating not only the discovery of vulnerabilities but also the development of ways to exploit them.

In the coming weeks, specialists expect a possible wave of attacks using the discovered PHP issues. Their impact will depend on how quickly owners of vulnerable systems install updates and whether attackers are able to automate exploitation of the flaws.

This case clearly shows that AI is changing the balance of power in cybersecurity: it helps find dangerous flaws, but at the same time accelerates the actions of those who want to exploit them.