Websites around the world were taken offline last week after two major flaws in a commonly used computer programming language were discovered.
The vulnerabilities in PHP, one of the most widely used website infrastructure programmes, risked allowing “unauthenticated remote code execution,” PHP developers said in a statement. The developers quickly released patches for the flaws and urged all users to immediately update their systems.
PHP powers around 70% of all websites worldwide, including major platforms like WordPress and MediaWiki. Websites ranging from Japan's weather service to parts of the BBC’s web portal were taken down when the flaws were made public. Several university and hospital websites were also disabled as a precaution.
If exploited, the vulnerabilities could expose various systems to unauthorized access, data theft, or disruption, cybersecurity experts and authorities warn. The European Union Agency for Cybersecurity, for instance, noted in a statement that all organizations should identify PHP-based applications and implement immediate updates, adding that where “remediation is not feasible, consider isolating exposed applications from public networks until fixes can be applied.”
The flaws, which were dubbed “PHP2Shell”, were discovered with AI models used by researchers at OpenAI and Calif, a cybersecurity firm. Wiz, the cloud computing and AI security company now owned by Alphabet, also identified the vulnerabilities.
“Independent teams of security researchers combined advanced AI models with human expertise to analyse PHP’s source code, identify the relevant weaknesses, develop practical ways to exploit them and test the proposed fixes,” explained Akshay Joshi, Head of the World Economic Forum's Centre for Cybersecurity,
To better understand this issue, we asked Joshi to further examine the PHP vulnerabilities and AI’s overall impact on cybersecurity. Here’s what he had to say.
What are the PHP flaws, and which versions or systems are affected?
PHP is the server-side programming language behind millions of websites and web applications. Two serious security flaws have been found in PHP itself. They can cause the system to mishandle information in memory—either when it runs out of space or when information from one website visit is incorrectly carried over to the next.
Together, the vulnerabilities could allow an unauthenticated attacker to execute code remotely, potentially take control of a website, access sensitive data or disrupt services. The flaws affect older and unpatched versions of PHP, including unsupported versions. The main fixed versions are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Updating WordPress or another website platform alone is not enough; the underlying PHP software also needs to be updated.
The risk is greatest for organizations running older or unpatched systems, given PHP’s extensive use across public and private digital infrastructure.
Which organizations at risk and how are they responding?
The greatest exposure is among organizations operating public-facing websites and applications on vulnerable PHP versions, especially those using older infrastructure or relying on third-party hosting, plugins and inherited systems that may not be fully documented.
This includes organizations using platforms such as WordPress, Drupal, MediaWiki, e-commerce systems and custom PHP applications. Essential service providers face particular pressure because even precautionary downtime can affect access to public services.
Organizations are assessing their exposure, coordinating with technology providers and prioritizing critical systems for remediation. Cloud providers and security companies are supporting this effort by patching or updating managed environments where applicable, strengthening network protections and sharing threat intelligence. Where risk cannot be reduced quickly, organizations may need to restrict access to or temporarily take affected services offline while remediation is under way.
If compromise is suspected, teams should preserve evidence, investigate the system and rotate passwords, access tokens, API keys and other credentials. Temporary mitigations may reduce exposure in specific circumstances, but the PHP project has made clear that updating is the only reliable remedy.
How does this discovery impact open-source software security?
AI was used to search complex code, identify suspicious memory behaviour, generate and test exploitation hypotheses, validate patches and examine whether related variants remained exploitable.
The broader lesson is that AI is changing the speed of vulnerability discovery. It can give defenders an important window to find and fix flaws before criminals do. But these same capabilities can also help attackers turn technical discoveries into working exploits more quickly.
The PHP incident also highlights a broader challenge in maintaining widely-used open-source software. Software that supports a large part of the global internet can depend on a relatively small number of maintainers, limited specialist capacity and complex coordination across contributors and users. A flaw can therefore remain unresolved for years, while the organizations that depend on the software may have little visibility into their exposure.
Beyond finding vulnerabilities, this highlights the importance of coordinating disclosure, patch development, testing and deployment quickly enough across the entire ecosystem.
What are the broader implications for cybersecurity infrastructure?
The incident shows how a vulnerability in one widely used software component can become a systemic risk, affecting governments, businesses, public services and cloud platforms simultaneously.
AI is likely to speed up both the discovery and exploitation of vulnerabilities, shortening the time organizations have to respond. This makes it essential for organizations to undertake comprehensive software inventories, map dependencies, patch rapidly, segregate critical systems and strengthen the security of widely used software components.
The central lesson is that cyber resilience depends not only on individual organizations, but also on the security and reliability of the shared digital infrastructure on which they all depend.
