PHP Flaws Prompt Website Shutdowns Worldwide

Researchers, including teams at OpenAI and cybersecurity firm Wiz, used AI tools to uncover two critical PHP vulnerabilities in software that powers roughly 70% of websites; the flaws had existed for years and could let unauthenticated attackers remotely execute code on affected servers, access sensitive data or take control of them. PHP developers issued emergency patches, and authorities including the FBI urged organizations to update immediately or take vulnerable sites offline if they could not patch them. Governments, banks and companies across Europe, Asia and the United States temporarily disrupted or suspended websites and online services as a precaution. Researchers reported a sharp rise in attempted exploitation after details became public, while officials in Japan said no damage had been reported there; experts also warned that public exploit details and patches could help attackers target unpatched systems. The findings highlighted AI’s growing role in discovering vulnerabilities and its potential to help attackers exploit them at scale.