HACKERS had already begun probing a pair of critical PHP flaws four days before the issues were disclosed publicly, with Amazon saying the vulnerabilities were “now being broadly exploited in the wild.” The weaknesses affect PHP, a language underpinning much of the internet, and are linked to the ability to access a server’s file system or database without login credentials. The US NSA and UK authorities warned that websites worldwide were exposed, with some governments reportedly taking sites offline to patch the flaws.
Patches were released by PHP’s maintainers on the same day, and the NSA urged immediate updates or, if feasible, taking systems offline until mitigations could be applied. Researchers from Calif and Wiz—the latter estimating that PHP powers around 70% of global websites—confirmed the vulnerabilities and collaborated with PHP to verify fixes.
OpenAI described the discovery as a demonstration of how AI can identify broad, internet-scale security weaknesses, while emphasising that AI can also accelerate the development of offensive tools. The White House indicated federal agencies were assessing potential impacts on government systems and critical infrastructure, and the UK’s National Cyber Security Centre urged immediate action by organisations to protect their websites and servers.
The report notes that WordPress’ dominance—being built largely in PHP—contributes to the widespread risk, and underscores the urgency of rapid, coordinated response across the public and private sectors.