Researchers at Calif and Google’s Wiz identified two critical vulnerabilities in PHP, the web language behind roughly 70% of websites, using a mix of advanced AI tools. The flaws, present in PHP’s codebase for years, could let an unauthenticated attacker execute code on a server and reach files or databases.¹

The discovery was initially presented as an example of AI getting to the bug first. OpenAI said frontier models had found the flaws before attackers and helped researchers validate fixes. Yet it also warned that the same capability could help attackers rapidly build offensive tools—a tension at the center of the response.²

By Tuesday, that response was already under strain. A proof-of-concept video demonstrating an exploit chain was briefly posted online, according to reports, accelerating the PHP Foundation’s planned patch release by a day. On Wednesday, patches arrived and the NSA told organizations running PHP to update immediately or take affected systems offline.³

That warning triggered outages as governments and other operators in Europe and the United States temporarily pulled sites down to patch. Japan’s prime minister, Sanae Takaichi, called for action that night and said suspending websites could reduce risk when a prompt fix was not possible.⁴

The most consequential dispute is over whether the race has already been lost in places. Amazon said it detected an exploitation attempt four days before public disclosure and that the bugs were “now being broadly exploited in the wild.”⁵ The PHP Foundation, however, said it had seen no evidence of working exploits—only incomplete or non-working generated code.³

As companies scramble, commercial tools are moving in too: Aravind Srinivas said users could receive credits to check PHP systems and GitHub deployment configurations for exposure.Aravind Srinivas (AravSrinivas)⁶ The immediate job is mundane but enormous: patch fast, or go dark.