AI tools discover severe PHP vulnerabilities that lay dormant for over a decade, threatening about 75% of websites worldwide

Global internet infrastructure is facing one of its most severe security threats since the widespread adoption of AI tools.

The U.S. National Security Agency (NSA) issued an urgent warning on Wednesday that researchers, using AI tools, had discovered two critical security vulnerabilities in the PHP programming language, putting a large number of websites worldwide at significant risk of being hacked. Government websites in the Netherlands, France, Denmark, Finland and several other countries were urgently taken offline.

The PHP development team released an emergency patch on Wednesday and called on all users to "update immediately." The vulnerabilities had lain dormant in the PHP codebase for more than a decade and were discovered this time by a U.S. cybersecurity company using AI tools from Google and OpenAI.

According to data from internet intelligence firm Censys, of the roughly 2.6 million hosts running PHP, about 1.5 million are currently using versions for which no patch is yet available. PHP underpins about 75% of websites built on known programming languages worldwide; WordPress, Drupal, Joomla and Magento are all built on this technology, so the knock-on effects of any critical vulnerability are extremely far-reaching.

OpenAI said on Wednesday that "given the severity of these vulnerabilities and the widespread use of PHP, we believe this is one of the most far-reaching security issues in recent memory," and stressed that "to our knowledge, frontier AI discovered these vulnerabilities before attackers did."

AI discovers PHP vulnerabilities that had existed for over a decade

The fact that AI tools were the first to discover these vulnerabilities marks a structural shift in the cybersecurity offense-defense landscape. Google's cybersecurity company Wiz disclosed in a blog post that its autonomous AI vulnerability research tool Wiz Atlas, combined with Google's Gemini 4 Argon and OpenAI's GPT-5.6 Sol, discovered the flaws.

Another cybersecurity company, Calif, also said it independently discovered the same vulnerability on August 1 using a large language model and has since been involved in remediation work. Both companies said they coordinated with each other and followed up on the response together with the PHP team and OpenAI.

Wiz noted that the vulnerabilities had been hidden in the PHP codebase for more than a decade and would be extremely difficult to exploit through manual investigation. "Before AI, this manual work was difficult to carry out, let alone scale," Wiz said. "With AI, that barrier no longer exists."

Costin Raiu, co-founder of cybersecurity research and incident response firm TLP:Black, warned that AI is driving a "race to exploit," and that the next step will be "mass compromise of all vulnerable web servers on the internet."

Seventy percent of websites at risk, with those lacking technical resources hit first

PHP was created in the early 1990s, originally standing for "Personal Home Page," and has now become one of the most important underlying languages on the public-facing internet. According to data from web technology tracker W3Techs, PHP powers about 75% of websites built on known programming languages.

Tiffany Farriss, interim CEO of the Drupal Association, said: "Any server using any PHP version from the past 20 years will be at risk from the vulnerability, and this issue affects the majority of sites on the internet."

Automattic, the operator of WordPress.com, has said that users of its hosting service and Tumblr users are not affected by the vulnerability.

But the risk is concentrated on smaller PHP-driven websites—especially sites run by individuals or organizations with limited technical resources, relying on shared hosting services and unable to directly manage the underlying servers.

Lukasz Olejnik, a visiting senior research fellow at King's College London, warned that "the sheer scale, combined with the involvement of AI, means attacks could happen immediately."

Governments respond urgently, wave of shutdowns sweeps Europe

European government agencies were the first to take precautionary measures, with websites in several countries taken offline one after another.

The Netherlands' National Cyber Security Centre (NCSC) also shut down its own website, describing the move as a "precautionary measure." The Port of Rotterdam, the government portal Overheid.nl, the Dutch football association KNVB, the official websites of the country's five major political parties and several hospital websites all followed by suspending services. The Dutch prime minister said he was closely monitoring developments.

Finland's state IT service provider Valtori announced that government public online services had been taken offline as a "precautionary measure." France's Interior Ministry said it had placed all of its websites in "preventive maintenance" status. Danish municipal IT company Kombit said it had shut down a number of services, including the national school communication platform.

Online encyclopedia Wikipedia said it had taken an undisclosed number of systems offline while awaiting the deployment of security patches; the online library Internet Archive also said it had briefly gone offline to deal with the issue.

Japanese Prime Minister Sanae Takaichi posted on X, calling on website operators to "check whether your online website uses PHP and be ready to apply the new patch." Risk disclosure and disclaimer

Markets carry risk, and investment requires caution. This article does not constitute personal investment advice and does not take into account the specific investment objectives, financial situation or needs of individual users. Users should consider whether any opinions, views or conclusions in this article are suitable for their particular circumstances. Investment based on this article is at the user's own risk.