Governments around the world are rushing to implement emergency safety measures after AI-assisted research uncovered severe vulnerabilities in PHP, the programming language that still powers a huge share of the web. Security agencies in multiple countries have issued advisories urging immediate patching.
What Was Found
Researchers using AI systems to audit programming-language internals discovered flaws in PHP rated as severe, potentially allowing remote code execution on unpatched servers. Because PHP underpins content management systems such as WordPress, Drupal and countless custom applications, the exposure is enormous — millions of sites could be affected.
The discovery method itself made headlines: AI models systematically probing language runtimes found bugs that years of human review had missed. For more on how AI keeps reshaping technology, see our report on GPT-6, the Gemini agent and Copilot billing changes.
How Governments Responded
Cybersecurity agencies moved fast. Emergency directives ordered public-sector websites to patch or isolate PHP workloads, while national CERTs published detection signatures and workarounds. Some governments temporarily restricted certain PHP functions on official hosting until fixes were verified.
Private-sector response was equally urgent. Major hosting providers pushed patches automatically, and e-commerce platforms audited checkout stacks for exposure.
Why PHP Still Matters So Much
PHP runs an estimated three-quarters of server-side websites. Its ubiquity means a single critical flaw can ripple across blogs, news outlets, online stores and government portals simultaneously. Attackers know this, and automated exploitation typically begins within hours of disclosure.
The incident has revived debate about memory safety, language maintenance funding and whether critical open-source infrastructure gets enough support.
What Site Owners Should Do
Update PHP to the latest patched release immediately, audit plugins and themes for abandoned code, and enable automatic security updates where available. Server operators should review logs for signs of probing and apply virtual patches at the web-application firewall layer if full upgrades need scheduling.
FAQ
Am I affected if my site uses WordPress? Likely yes, since WordPress runs on PHP. Update both PHP and WordPress core without delay.
How were the flaws discovered? AI-assisted auditing tools systematically tested PHP internals and flagged the severe issues for human confirmation.
What should governments do next? Patch public systems, publish indicators of compromise, and fund long-term maintenance of critical open-source software.
Will AI find more such flaws? Almost certainly. Automated auditing of widely used software is only accelerating.