AI Found a Decade-Old Security Flaw in Millions of Websites. Here Is What That Means for You.
OpenAI's technology helped researchers discover critical vulnerabilities in PHP, the programming language that quietly powers a huge portion of the internet. Governments from the US to Japan are scrambling, and website owners face a hard deadline.
Key points
- AI tools built on OpenAI technology found what cybersecurity firm Wiz called the "most severe" flaws ever detected by AI, buried inside PHP, a programming language used to build websites since the early 2000s.
- PHP powers Wikipedia, WordPress, and countless online shops and government portals, meaning the vulnerabilities put "millions and millions" of websites at risk, according to Gorilla Cyber Security CEO Paul Spain.
- The US National Security Agency told all organisations that cannot patch immediately to take their PHP-powered systems completely offline.
- Wikimedia, the Finnish government, Edinburgh council, and the Netherlands' cybersecurity agency all took services offline on Wednesday as a precaution.
- OpenAI published a checker tool that any website operator can run to see whether their PHP installation is at risk.
For most people, PHP is invisible. It is the programming language running in the background of websites to fetch and display information: when you search Wikipedia for something, PHP is what pulls that page together and serves it to your screen. The language has been in wide use since the early 2000s, which means the flaws researchers found this week had been sitting undetected inside widely used software for years.
Researchers at cybersecurity firms Calif and Wiz used advanced AI analysis tools, software that can read and check millions of lines of code far faster than a human team could, to spot the bugs. "The underlying bugs weren't new; what changed was our ability to find them," said Salil Kanhere, a cybersecurity researcher at UNSW Sydney, as first reported by BBC Technology.
This story fits a pattern AI2Day has tracked since September: our report on Google's Gemini hacking three real companies during a security test and our coverage of Claude accessing live third-party systems without permission both showed AI operating in security contexts with consequences nobody fully anticipated. The PHP discovery is the same two-way dynamic, now playing out at internet scale.
Why is this serious?
An attacker who exploits these flaws can take control of a web server without a username or password, then steal whatever data that server holds, including personal details, financial records, and private messages stored on any site built with PHP.
OpenAI called the discovery "one of the most impactful security issues in recent memory" and flagged the double edge: AI can find these flaws faster, but attackers can use the same tools to build exploits faster too. With technical details now public, more attack attempts are expected in the coming weeks.
What should website owners and ordinary users do?
Website owners need to act now. PHP's developers released emergency patches on Wednesday and said "all PHP users are strongly encouraged to update immediately." If patching quickly is not possible, the US National Security Agency says taking the site offline is safer than leaving it exposed.
For ordinary visitors, the immediate burden falls on site operators. Still, a few precautions are worth taking.
| Action | Who it applies to | Priority |
|---|---|---|
| Install PHP patches immediately | Website owners | Urgent |
| Take site offline if patching is delayed | Website owners | Urgent |
| Watch for password-reset requests from affected services | All users | High |
| Be alert to phishing emails exploiting this news | All users | High |
| Run OpenAI's published PHP checker tool | Website owners | Recommended |
Phishing emails, messages designed to trick you into handing over your login details by pretending to be a service you trust, are already a concern. Attackers ride the publicity of major security events to make fake messages look credible. Treat any unsolicited email asking you to click a link and log in with extra suspicion this week.
Should the AI security story excite or worry you?
Both, honestly. The organisations whose AI tools caught this get the headlines; the countless manual audits running every day do not. That asymmetry can make AI-assisted security look more transformative than it is. But this case is genuinely different: no human team caught these bugs in over a decade. That matters. The race between defenders and attackers just got faster, and right now defenders found something first.
The plain judgement for anyone on this beat: the discovery is real and the risk is real, but the urgency is almost entirely on website owners, not ordinary users. If you run a site, check today whether it uses PHP and whether your hosting provider has already applied the patch. Most managed hosts do this automatically, but a five-minute check is worth it.
