Artificial intelligence models catch decade-old vulnerabilities in PHP and trigger web defenses worldwide

Advanced artificial-intelligence models have uncovered two critical security vulnerabilities in the programming language PHP that had remained hidden for more than a decade, prompting government agencies and international organisations to take their digital sites and public portals offline to avoid compromise.The unprecedented discovery, carried out by security researchers at Wiz and Calif using leading models developed by OpenAI, reflects a fundamental shift in the balance of cyber-security; Wiz described the two flaws as the most dangerous vulnerabilities that artificial-intelligence systems have uncovered to date.

The danger of the two flaws lies in their ability to execute malicious code remotely without prior security authentication, a risk warned about by the Computer Emergency Response Team of the European Union, while the U.S. National Security Agency confirmed that the gaps give attackers a direct path to a server’s file system and its sensitive databases. Wiz researchers estimate that roughly seventy percent of the Internet could be exposed to this threat, given the prevalence of the language in the architecture of shared-hosting servers and control panels that manage large-scale content-management and e-commerce platforms such as WordPress, Drupal, Joomla and Magento.

The use of frontier models was not limited to detecting the flaw; it also enabled researchers to build and adapt fully integrated exploit software across multiple applications within a matter of hours.This rapid pace suggests that AI tools themselves could become weapons in the hands of threat actors, a development that is already materialising on the ground according to Dani Nekt, senior technology officer at Cloudflare, who confirmed the observation of initial attacks and emerging exploitation attempts in the first hours after the update’s release, while Sophos’s threat-response unit classified the vulnerabilities as a top-priority target for hackers, warning that some attackers may already have entrenched themselves within compromised systems before the issue was addressed.

The alert did not lag on the political and legislative front globally, as the Finnish government quickly shut down its public web services, while the Dutch Cybersecurity Agency announced the suspension of its official website alongside those of the National Institute for Public Health and the House of Representatives. In Washington, the White House confirmed coordination among federal agencies and AI labs to accelerate remediation, and Japanese Prime Minister Sanae Takaichi issued a call on X for the inspection of public sites, while cybersecurity bodies in the United Kingdom, the European Union and Australia urged the immediate disconnection of any system from the Internet if the emergency patch released by the PHP Foundation for modern releases could not be installed, continuing to warn about the fragility of systems running versions older than 8.1, which historically extend back to version 5 released in 2004.

The real challenge for infrastructure and cyber-security teams in the Gulf, Egypt and the Arab Levant goes beyond deploying a urgent security patch; the bigger hurdle lies in identifying hundreds of intermediate systems and legacy sites that operate covertly within organisations.The region’s heavy reliance on long-standing hosting environments and enterprise web applications exposes companies, banks and government agencies to silent infiltration risks; the rapid generation of exploits by smart models eliminates the usual grace periods for testing updates, forcing information-security managers to immediately isolate vulnerable servers and audit access logs for any proactive breach, rather than waiting for regular upgrade cycles to complete.