AI-Discovered PHP Vulnerabilities Trigger Global Web Disruptions and Urgency to Patch

Critical vulnerabilities in the PHP programming language—dubbed "PHP2Shell"—have triggered emergency site shutdowns and international security advisories across the internet. OpenAI has taken credit for using AI to identify the security flaws, forcing organizations worldwide to rapidly apply patches or take their systems offline.

The impact of the security flaws has reached major online platforms, government services, and online games, demonstrating how deeply embedded PHP remains in global internet infrastructure.

Global Outages and Official Security Warnings

The newly highlighted vulnerabilities have affected a broad range of web services and online communities. Affected platforms include Wikipedia, 4chan, DeviantArt, and local blogs. According to media reports from Kotaku, online gaming platforms such as Pokémon Home and Pokémon Champions were also taken offline.

Government infrastructure has felt the impact as well. Government agencies in the Netherlands and Finland took down their websites as a precautionary measure.

The widespread disruption prompted warnings from major cyber defense organizations:

• The NSA Cybersecurity account on X recommended that organizations take their systems offline if an immediate update is not feasible.
• The UK’s National Cyber Security Center issued a matching advisory recommending offline action when immediate patching cannot be completed.

A 20-Year-Old Bug Lowered by Advanced AI

According to security firm Wiz, the underlying flaw is not new—it has been present in PHP for roughly 20 years. Historically, exploiting the flaw "required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve."

However, the arrival of increasingly powerful AI models has altered the cybersecurity landscape. These models have made it significantly easier to transform obscure, highly complex code bugs into dangerous, practical vulnerabilities. While OpenAI discovered the flaws using AI tools, the broader security implications highlight how modern AI capabilities can surface deeply hidden flaws that managed to fly under the radar for two decades.

The Massive Footprint of PHP

The PHP programming language remains a core component of server-side web infrastructure. Data from survey service W3Techs shows that PHP is used by 69.3 percent of all websites with a known server-side programming language, powering popular sites like Wikipedia as well as any site built on WordPress.

Additionally, internet security site VirusTotal reports that its scanner currently registers approximately 3.8 million sites running PHP with at least one port open, underscoring the vast surface area exposed to these critical vulnerabilities as administrators race to apply security patches.