AI-found PHP flaws prompt website shutdowns and emergency patching

Governments and companies shut down websites while responding to two critical flaws in PHP, a programming language used by about 70 percent of websites, according to Wiz Research. PHP programmers released a fix on October 21, and authorities urged organizations to patch immediately or take vulnerable systems offline. [5] Security firm Calif discovered the flaws in August using OpenAI's GPT-5.6 Sol during an OpenAI-funded audit. [5] Why it matters: AI-assisted discovery can expose weaknesses in widely used software faster than operators can necessarily repair them. The exposure is narrower than PHP's overall footprint: AFP reports that only sites running PHP on their own servers are affected. [5] Key insights: Amazon Threat Intelligence identified a hacking attempt before public disclosure, but said it was unclear how the actor obtained exploit information. [5] | Calif researcher Ryan Austin said exploitation did not appear widespread at the time of reporting; discovering a severe flaw is not the same as establishing widespread compromise. [5] | Many large platforms stayed online because they used other languages or had operators able to install the fix quickly. [5] Cheatsheet facts: What happened: Two critical PHP flaws prompted website shutdowns and emergency patching. [5] | Why: Calif found the flaws using GPT-5.6 Sol in an OpenAI-funded audit of PHP's code. [5] | Who pays: Operators of exposed, self-hosted PHP sites must patch or take vulnerable systems offline, interrupting access where shutdowns are necessary. [5] | The catch: PHP helps run about 70 percent of websites, but that does not mean every PHP website is exposed or compromised. [5]