AI agents helped uncover vulnerabilities in PHP that could enable remote code execution, prompting security warnings and emergency patching.
Organizations in Europe and the United States temporarily took some websites offline on October 21 while responding to vulnerabilities in PHP, a programming language widely used to build websites and web applications. The FBI warned that the flaws could allow remote code execution, potentially exposing sensitive data and networks. It advised operators to take affected sites offline if they could not update them immediately.
The PHP Foundation released fixes and instructions for updating systems. OpenAI said it had coordinated a two-month effort with researchers, security providers and other partners to identify and address vulnerabilities before disclosure. The company named Wiz and Cloudflare among the collaborators supporting research, technical work and preparations for the fixes. OpenAI said its AI agents helped find the flaws and that they appeared to be identified before attackers discovered them.
The incident illustrates a consequential cybersecurity use of AI: helping researchers detect weaknesses in software that underpins internet services. It also highlights the operational pressure that can follow disclosure. Even when fixes are available, website operators must identify affected systems, apply updates and assess exposure; agencies recommended temporary shutdowns where immediate patching was not possible. The Finnish government’s website was among those reported as partly unavailable while the issue was being addressed.
Security experts cautioned that the discovery does not mean every PHP site is vulnerable. However, an Arctic Wolf executive cited PHP’s prevalence—roughly 70% of websites where the server-side language is known—as a reason the potential exposure warrants swift attention. The episode also sharpens a broader debate: AI can help uncover vulnerabilities, but the same acceleration makes responsible disclosure, coordinated patching and controls on increasingly capable tools more important. For organizations operating PHP-based services, the immediate priority is to consult the maintainers’ guidance, apply the relevant fixes and review systems for signs of exposure.