On 20 October, an alert was sent out by popular server-side programming language PHP warning users that an urgent security update would be available for download the next day, but while security patches are routine in cyber security, this PHP patch was to be far from normal. The fix was uploaded on 21 October, alongside a warning that any webpage without the update was at risk from ‘two critical vulnerabilities’, in a scramble that left large parts of the internet offline while systems were updated.
PHP, shorthand for PHP: Hypertext Preprocessor, is a webpage programming language that has been used widely across the internet since the 1990s, powering around 70% of global websites. While PHP has always contained low level vulnerabilities, with over 2,000 recorded in 2026 as per the National Vulnerability Database, these two vulnerabilities have been described as “rank[ing] among the most severe… in software history” by its discoverers. The vulnerabilities would allow potential hackers to execute code on websites using PHP, allowing them to steal sensitive information like passwords and authorisation keys.
While PHP has always contained low level vulnerabilities these two vulnerabilities have been described as “rank[ing] among the most severe… in software history” by its discoverers.
Wiz, the company behind the discovery of the exploits, have credited AI for their discovery, describing the work to discover these bugs pre-AI as “difficult to implement and even harder to scale”. They said that AI had “reduced the effort needed to develop and adapt complex exploits” and described it as an “AI frontier”. The effort to fix these vulnerabilities, which were discovered in August but kept quiet to allow the development of a solution, spanned across the entire industry, with Wiz working with partners such as OpenAI, AWS, Microsoft, and the PHP team themselves.
Following the release of the patch, affected websites scrambled to download the fixes, with sites such as Wikimedia, the organisation behind Wikipedia, as well as webpages owned by the Finnish Government, Edinburgh Council, Netherlands’ cyber security agency, as well as some BBC pages being pulled offline, with the vast majority coming back online within a day.
The discovery of these critical vulnerabilities by AI seemingly spells out a new era for cyber security, with it taking over the roles of teams of cyber specialists. While AI was used by so-called ‘white-hat hackers’ – those who search for exploits to patch them – who’s to say that next time AI won’t be used in ransomware attacks like the WannaCry attack that affected NHS systems in 2017, or data leaks such as the ASOS breach earlier this month?
The discovery of these critical vulnerabilities by AI seemingly spells out a new era for cyber security
