Amazon warned on Wednesday that a critical vulnerability in PHP, the programming language that powers a large share of the web, is being widely exploited after being uncovered with the help of artificial‑intelligence tools. The cloud giant said it detected an attempt by threat actors to abuse the flaw four days before the issue was disclosed publicly, and that attacks are now occurring “in the wild” on a broad scale.
The U.S. National Security Agency and the United Kingdom’s cyber authority issued alerts the same day, saying the weaknesses left countless websites exposed. Some European governments have begun taking sites offline while they apply patches for the two security bugs.
The flaws, which had gone undetected for more than ten years, were identified with assistance from OpenAI and Google models. Their discovery underscores how AI can reshape cybersecurity. Earlier this year, new AI models from Anthropic and OpenAI with advanced cyber capabilities prompted warnings from politicians and financial regulators, and the U.S. government temporarily restricted their deployment.
The NSA urged every organization that runs PHP to install the updates immediately or, if that is not possible, to shut the affected systems down until they can be fully mitigated. “These vulnerabilities often provide a direct path to the server’s file system or database,” the agency said. “If an immediate update is not feasible, it is recommended that organizations take the system offline until it can be fully mitigated.”
The vulnerabilities were discovered by researchers at two U.S. security firms, Calif and Wiz. Wiz, owned by Alphabet, estimated that PHP powers roughly 70 percent of all websites worldwide. OpenAI called the issue “one of the most impactful security problems in recent memory,” adding that frontier AI found the bugs before malicious actors did. The lab noted that while AI can reveal large‑scale security flaws, the same technology can also help attackers craft exploits quickly.
OpenAI collaborated with the PHP development team, Calif and Wiz to verify the problems and create patches, which were released on Wednesday. The White House said federal agencies are reviewing the potential impact of the bugs on government systems and critical infrastructure.
PHP’s pervasive presence on the internet is largely due to WordPress, the dominant website‑building platform, which is written primarily in PHP. The UK’s National Cyber Security Centre warned that the vulnerabilities could let a hacker take control of a website’s server without needing a password or other credentials, and urged UK organisations to act without delay.