In mid-August, researchers at AI firm Calif and Google-owned Wiz identified two severe flaws in PHP, the decades-old language used by roughly 70% of websites with known server-side programming. The bugs could permit unauthenticated remote code execution—effectively letting an intruder run code on a vulnerable server. Calif used OpenAI’s GPT-5.6 Sol; Wiz used a combination of AI tools. ¹

The danger was not merely that PHP was vulnerable, but that a weakness believed to have existed for about two decades had become much easier to weaponize. Wiz said exploitation once required an “exceptionally complex chain of steps” near the edge of what human researchers could achieve. ² Security experts now argue that AI has narrowed the old buffer between disclosure and attack: Tolmo researcher Matt Suiche said his team built a working exploit in less than a day, a task that previously could have taken weeks. ¹

Then the disclosure race accelerated. Details leaked online before the planned release, Calif briefly posted a proof-of-concept video, and the PHP Foundation moved its patch forward by a day. Amazon Threat Intelligence had already observed an exploit attempt days earlier; Cloudflare later reported attacks rising from thousands before disclosure to millions afterward. ³

By Wednesday and Thursday, the defensive response became visible to ordinary users. Governments in Finland, the Netherlands, Britain, Germany and Japan took services offline or urged companies to do so; businesses and platforms followed suit while patches were installed. For large institutions, one small-business adviser called the disruption a “speed bump”; for smaller firms, outages lasted as long as seven hours. ⁴

The consensus was patch first, but not panic. The PHP Foundation said it had no evidence of successful remote-code execution, while Dataminr reported scanning and non-working exploits rather than known compromises. ⁵ Yet legacy sites face a harder choice: unsupported PHP versions may lack official fixes, risking permanent disappearance. Amid that scramble, Aravind Srinivas promoted free credits for an automated PHP exposure check—another sign that AI is becoming part of the repair kit as well as the threat model. Aravind Srinivas (AravSrinivas)⁶