AI Model Helps Uncover Critical Vulnerabilities in PHP, the Programming Language Behind Many Websites

Summary

Security officials are warning about two critical vulnerabilities in PHP, an open-source programming language used on nearly 70% of websites, which could let hackers take control of vulnerable web servers without a password or other credentials. Researchers found the bugs partly with an OpenAI model, and OpenAI said in a blog post that the same capabilities that found the flaws could also help attackers rapidly develop offensive tools and exploits. Government officials from the U.S. to Japan are urging companies to apply a patch or consider taking their sites down. Matthew Prince, CEO of Cloudflare, said the company saw thousands of attempts to exploit the flaws in the 10 hours before the public announcement, a figure that rose to tens of thousands within 45 minutes, hundreds of thousands within two hours and millions by the time he wrote on X. The New York Times reported that the disclosure heightened concerns about the potential for AI to upend cybersecurity unless shortcomings are addressed.

Timeline

1. The New York Times

   21 Oct 2026, 19:04 UTCSource ↗

   Reports that AI discovered a critical vulnerability in PHP, and that the disclosure heightened concerns about AI's potential to upend cybersecurity unless shortcomings are addressed.

2. Axios

   21 Oct 2026, 21:26 UTCSource ↗

   Reports that security officials are sounding the alarm over two critical PHP vulnerabilities that hackers could easily exploit, and that OpenAI touted its model's role in discovering one of them while government officials urge companies to patch or take their sites down.