Security researchers used artificial intelligence to find decade-old vulnerabilities in software that runs most websites.
Governments and cybersecurity agencies across the world urged website operators on Wednesday to apply emergency software updates or take their platforms offline after researchers discovered major security flaws in PHP. The programming language, which has been in widespread international use since the 2000s, powers web platforms across the globe.
Cybersecurity firms Calif and Wiz found the vulnerabilities by using an advanced artificial intelligence model developed by OpenAI, BBC News reported. The bug, dubbed PHP2Shell, had remained undetected in the software for at least ten years, according to CBS News. The discovery prompted quick warnings from intelligence services and government officials after technical details leaked online earlier in the week.
Global disruption as websites go dark
The warnings led multiple public and private institutions to shut down internet portals on Wednesday to prevent intrusions. Wikimedia temporarily pulled down several internal systems as a safety step. Government sites in Finland, council pages in Edinburgh, and online services at the University of Geneva were removed from the web. The cybersecurity agency of the Netherlands also took its own website down.
Public bodies across Scotland, including local health boards and regional councils, disabled web pages while evaluating their exposure. Some pages operated by the BBC were also taken down. Japanese Prime Minister Sanae Takaichi posted an urgent alert to the public on X, urging administrators to examine whether their public-facing websites relied on the language and asking them to act immediately. She noted that temporarily suspending websites remained a practical method to lower danger if administrators could not apply fixes right away.
In the United States, the National Security Agency warned that the vulnerability offered an attacker a direct path into system databases. The agency directed all federal departments and agencies to patch their systems immediately or pull them offline. The FBI cyber threat division cautioned that criminals could exploit the opening to insert unauthorized software remotely, which could expose computer networks to tampering.
How artificial intelligence uncovered the bug
The programming language at the center of the alert forms part of the underlying structure of the internet. The outlets gave differing explanations for its name: BBC News reported that PHP stands for PHP: Hypertext Preprocessor, while CBS News reported that it stands for Personal Home Page. Up to 70 percent of websites and web services worldwide use the language, including platforms such as Facebook, online retail shops, and WordPress.
Researchers had long suspected unusual activity in the code, but human developers could not easily turn the software bugs into working exploits. The complex, repetitive task of examining the code took artificial intelligence tools to resolve. The AI models parsed the structure far faster than human teams could manage, bringing the longstanding vulnerabilities into view.
Security specialists noted that the underlying software flaws were not newly created. Instead, they had been written years ago when developers prioritized system functionality rather than security. The developers of the PHP platform, alongside the PHP Foundation, distributed official security patches on Wednesday to repair the openings and published instructions explaining how administrators should update systems.
Risks to systems and consumer accounts
The two critical vulnerabilities permit attackers to take control of affected servers without needing prior login clearance. That level of unauthorized access allows intruders to alter site contents, install malware, disable pages, or extract stored records.
Security experts warned that the danger is especially acute for smaller organizations that lack dedicated IT teams to keep software updated. Because technical specifics about the flaw are now circulating publicly, security analysts expect exploitation attempts against unpatched systems to rise over the coming weeks.
For ordinary web users, simply visiting an affected website does not automatically infect a personal computer or phone. The main danger stems from accounts created on vulnerable platforms, including booking services and e-commerce stores. Attackers who compromise an unpatched server could steal saved personal records such as names, email addresses, street locations, and birth dates. Security advisers said consumers do not need to halt internet shopping or browsing, but they should watch for phishing attempts and follow instructions from services requesting password changes.
