Context:

A global rush to patch a critical PHP flaw threatens millions of websites as researchers using AI uncovered decades‑old vulnerabilities that could allow remote control of servers and data theft. Governments and major firms pressured operators to apply fixes or take systems offline where remediation isn’t feasible, signaling a rapid shift toward containment over immediate restoration. The disclosure exposed the vast reach of PHP-powered sites and highlighted the dual-use potential of AI in both finding and weaponizing security gaps. Analysts say this underscores the need for ongoing, rigorous vetting of widely used software and faster deployment of mitigations. The situation remains fluid as organizations scan for exposure and implement fixes, with cautious optimism about stronger defenses to come.

Dive Deeper:

• Researchers from the security firms Calif and Wiz used advanced AI tools to analyze code and identify the vulnerabilities, accelerating discovery beyond human capability and enabling a rapid public disclosure that prompted widespread remediation.

• The flaws are described as potentially affecting a large portion of the internet, with estimates from Wiz suggesting roughly 70% of sites could be exposed, a figure the BBC notes could not be independently verified.

• Governments and major companies, including the UK’s NCSC and counterparts in the EU and Australia, urged affected operators to apply fixes and, when immediate remediation isn’t feasible, to consider taking systems offline to prevent exploitation.

• The vulnerabilities could allow attackers to take control of affected web servers without authentication and to exfiltrate sensitive data, placing a broad ecosystem of PHP-powered platforms at risk.

• Among the affected or temporarily disabled services are global platforms and public-sector sites, with high-profile examples prompting temporary shutdowns as precautionary measures while mitigations are rolled out.

• OpenAI characterized the discovery as one of the most impactful security issues in recent memory, while industry experts stressed that the underlying bugs were longstanding but now more detectable thanks to AI-assisted analysis.

• Authorities are actively identifying potential exposure across online services, and the incident has heightened attention on how AI can both reveal security flaws and enable rapid development of new exploits.