Critical PHP flaws raise fears of faster AI-enabled hacking

AI-assisted researchers have uncovered critical vulnerabilities in PHP, prompting warnings that security teams may struggle to fix weaknesses as quickly as automated tools expose them. The flaws, announced on 21 October, potentially affected millions of websites. Some experts estimated that 70% of all sites on the internet were at risk of hacking.

Government and private websites across the US and UK temporarily went offline to apply patches. The US National Security Agency urged sites running PHP to implement fixes immediately, warning that unauthorized server access could enable data theft, service disruption or deeper network intrusion. Cloudflare CEO Matthew Prince reported a sharp increase in exploitation attempts after disclosure, reaching millions.

Executives including OpenAI’s Sam Altman and Anthropic’s Jason Clinton warned that AI-driven discoveries could overwhelm patching efforts, particularly for critical infrastructure. The concern extends to attackers using the same tools to exploit newly identified bugs faster. Researchers at security platform Wiz said the underlying PHP flaws had existed for decades, but proving they could be exploited required an exceptionally complex sequence of steps near the limits of practical human research.