AI uncovers decade-old security flaw threatening 75% of world's websites

A critical security vulnerability has been discovered in a programming language used by more than 70 percent of websites worldwide, putting companies and institutions on high alert. AI played a decisive role in uncovering the flaw — a development that also signals hackers could harness AI to launch large-scale attacks.

The Wall Street Journal, Reuters and other outlets reported Wednesday (local time) that the developers of PHP, a programming language widely used in website development, had released an emergency update patching two critical security vulnerabilities. The flaws allow hackers to remotely execute arbitrary code or take control of systems without any login or authentication.

The scale of the threat is magnified by PHP's ubiquity: the language powers 75 percent of all websites globally. WordPress, the website creation and management platform used by roughly 43 percent of all websites, also runs on PHP.

The vulnerabilities, identified with the help of AI, are assessed as serious security flaws that had gone undetected for more than a decade. Cybersecurity firm Kalif discovered the PHP vulnerabilities using OpenAI's model GPT-5.6 Sol. Google-affiliated cybersecurity firm Wiz independently found two vulnerabilities and reported them to the PHP Foundation.

The flaws had existed in PHP's code for years and had previously been flagged as potential problems, but were long considered too difficult to exploit in a real attack. Kalif, however, is reported to have carried out a live demonstration of an exploit.

Ami Luttwak, co-founder of Wiz, called the flaw "the most serious security vulnerability ever discovered by AI," adding that it would have been "too complex to find without AI." OpenAI said in a statement that it considers the vulnerability "one of the most impactful security flaws of late, given the severity of the flaw and the widespread use of PHP."

PHP's developers had originally planned to release the security patch Thursday, but moved the release up by a day after details of the vulnerability leaked on an online forum Tuesday.

Some hackers had already begun exploiting the vulnerability before the patch was released. Dane Knecht, chief technology officer of web and cloud security firm Cloudflare, said "early attack attempts are emerging" and that the company was "updating countermeasures as new attack vectors are identified." Several European government agencies, including those in the Netherlands and Finland, took their websites offline as a precaution. Cybersecurity authorities in Europe, Japan and Australia issued urgent update advisories, while the US National Security Agency directed PHP-using organizations and companies to take their systems offline if they were unable to install the patch promptly.