Governments and companies around the world are racing to patch their websites — or taking them offline until they can be fixed — after the discovery of major security flaws in PHP, a piece of software that underpins much of the internet.
OpenAI, whose artificial intelligence models were used to find the bugs, said in a blog post that it was “one of the most impactful security issues in recent memory,” given PHP’s widespread use.
While many websites were taken down as a protective measure, as of Thursday afternoon, there had not been any confirmed successful attacks using the PHP flaws, according to an analysis by Dataminr, a risk-intelligence cybersecurity company.
“Observed activity since vulnerability disclosure remains limited to scanning, fingerprinting and use of non-working exploits, with no known compromises,” Dataminr said, though it added it was “only a matter of time” before successful intrusions would occur.
What is PHP?
PHP, short for PHP: Hypertext Preprocessor, is a decades-old, open-source programming language that is used to build and run web applications. By some estimates, about 70% of all websites and web applications use the software.
Services in which PHP is a core ingredient include content management systems like WordPress and Drupal, which help people run websites. Because PHP is a sort of foundational code baked into so many platforms — think of it as invisible digital infrastructure — many businesses may not even realize they rely on PHP.
How was the flaw discovered?
Security researchers discovered issues in the programming language that could be exploited by an outside attacker.
The bug, which has been hidden in the software for years, was identified by researchers at Calif, a small, U.S.-based cybersecurity company, using OpenAI’s GPT-5.6 Sol model. Researchers from Wiz, an Israeli-American security firm owned by Google, also independently reported the vulnerabilities.
The flaw is the latest to be discovered using advanced AI tools, which cybersecurity experts have warned are dangerously effective at finding bugs and weaponizing them. In its blog post, OpenAI said that the discovery of the PHP vulnerability highlighted “how AI can uncover security flaws with internet-scale impact, but the same capabilities can also help attackers rapidly develop offensive tools and exploits.”
The company added that, as far as it was aware, “frontier AI found these vulnerabilities before attackers did.”
What are the risks?
Given that PHP powers much of the web, security professionals are concerned that hackers could move quickly against unpatched systems, manipulating how they operate and stealing the private data they contain. Experts also cautioned that because the technical details are now public, malicious actors can reverse-engineer a patch to rapidly increase their attempts exploit the vulnerability.
That creates an unusually urgent race to update systems. While AI models can help spot vulnerabilities, it can also be used to target many victims at once.
The PHP disclosure was further complicated by a leak before the patch. On Tuesday, details of the bugs were mentioned in a post on a hacker forum, which prompted the nonprofit foundation that oversees the software to release a fix a day earlier than planned.
Have attacks already started?
The defenders and hackers began racing to protect or compromise systems Wednesday when the patch was released. But there were signs of an earlier leak from the group of security researchers working to create the fix.
Late Wednesday, Amazon revealed in a blog post that it had data showing that an unknown actor had attempted to use the PHP attack four days before the patch’s release against a honeypot network, or a decoy system, that the company maintains. (A honeypot network tries to catch cybercriminals in the act of doing something nefarious.)
The identity of the attacker was unknown, but the early activity suggested that hackers could have been readying attacks for days before a fix was released.
“It remains unclear how the actor acquired exploit information prior to disclosure,” C.J. Moses, the chief information security officer at Amazon, said in the blog post.
Which sites are affected?
Sites that rely on PHP are vulnerable, which means a good chunk of the internet.
Matthew Prince, the CEO of Cloudflare, which helps websites secure and manage internet traffic, said in a social media post Wednesday that the company “saw thousands of attempts to exploit” the flaw in the hours before it was publicly announced.
“That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now,” Prince added.
Several government websites in Europe and Asia went offline as a precautionary measure.
The Dutch cybersecurity agency, Internet Archive and the operator of Wikipedia took down a number of its systems. In Britain, the prime minister’s office said some government services might be offline Friday.
On Thursday morning, the website of Finland’s government displayed a message to users: “The websites of the government are fully or partially unavailable. We are currently resolving the issue. Please try again in a moment.”
Prime Minister Sanae Takaichi of Japan urged operators whose sites rely on PHP to apply the patch as soon as possible. For those unable to do so immediately, she wrote on social media, temporarily suspending websites and similar measures could be effective in reducing risk.
Should regular internet users be concerned?
Because PHP is so pervasive, the collateral damage could fall on everyday users whose personal data and essential online services depend on sites staying secure. Consumers could experience online disruptions in the coming days with certain businesses or government services.
This article originally appeared in The New York Times.
