The home page of the PHP.net website is seen on October 22, 2026 in Singapore. Cybersecurity flaws were recently identified in the popular PHP programming language, which is used on a large number of websites around the world, including those of large companies and national governments. The PHP Foundation released two patches designed to fix the vulnerabilities.
Yong Teck Lim/Getty Images
hide title
Yong Teck Lim/Getty Images
A few months ago, AI caused global alarm after it was discovered that autonomous agents had cheated in assessments and then attempted to cover it up, in what became known as the “Hugging Face hack.”
This week, AI and hacking are back in the spotlight, with AI technology credited with helping prevent a global cybersecurity crisis.
Cybersecurity company Wiz Research, which uses OpenAI technology, announced On Wednesday it discovered security flaws in a computer programming language that helps run about 70 percent of the world’s websites.
OpenAI called the bug “one of the most impactful vulnerabilities in recent times.” Wiz Research warned that its “successful exploitation could allow attackers to take control of affected servers, steal sensitive data, and deface websites running on them.”
Corporations and governments from the United Kingdom to Japan are now rushing to prevent hackers from exploiting the flaws.
The flaws were discovered in a major programming language called PHP, short for Hypertext Preprocessor. Wiz Research calls PHP “the backbone of the web,” and says the technology has underpinned much of the Internet since the 1990s.
“These findings are among the most serious vulnerabilities discovered in PHP, and possibly in the history of software,” the firm said, adding that before publicly revealing the flaw, teams had worked on building a solution that is now available for websites to protect themselves.
As countries scrambled to prevent cyber attacks, numerous websites and pages were taken offline in recent days. The US National Security Agency warned organizations using PHP to “maintain increased awareness” in the coming weeks. The UK’s National Cyber Security Center called on organizations to “take immediate action” to update their websites to the latest fixed or patched version.
This week dozens of British and Finnish government services went offline. In France, many local government sites were also briefly closed. China’s Ministry of Industry urged entities to review security breaches.
In Japan, Prime Minister Sanae Takaichi turn off “an urgent request for everyone to take action,” adding “if it is difficult to apply the patch quickly, temporarily suspending websites and similar measures can be considered an effective way to reduce the risk.”
Matthew Prince, director of cybersecurity company CloudFlare, saying His organization saw tens of thousands of attempts to exploit the flaw within the first 45 minutes of its discovery. Now there are millions, Prince said Thursday.
Wiz Research said the flaws in PHP had been present for decades.
“But demonstrating its exploitability required an exceptionally complex chain of steps, on the edge of what human researchers could practically achieve,” the organization said. AI models have “substantially lowered that barrier, turning a long-standing flaw into an exploit.”
