AI Finds Flaw in Popular Web Hosting Software, Sparking Global Race to Patch

The creators of PHP, an open source programming language used by the majority of the world’s websites, on Wednesday urged web maintainers across the globe to install a new update after researchers using AI found a flaw that could put those websites at risk of being hacked.

The flaw is the latest illustration of how frontier AI models have effectively eclipsed the capabilities of human cybersecurity experts. Researchers at Calif.io, a cybersecurity startup, said they first discovered the PHP vulnerability in August using OpenAI’s GPT-5.6 Sol AI model and shared their findings with the nonprofit group that maintains PHP. The maintainers formed a working group with Calif.io and other firms including OpenAI and Google that raced to develop a patch that was subsequently released Wednesday.

PHP is a programming language used widely to build websites. The flaw has existed in PHP’s code for decades, the researchers said.

Researchers from Google’s Wiz cybersecurity unit, who assisted PHP maintainers with the patch effort and discovered other PHP flaws related to Calif.io’s disclosure, said in a statement on Wednesday that the vulnerabilities could put 70% of the world’s websites at risk if they aren’t patched quickly, and called them “the most severe vulnerabilities ever discovered by AI, if not in all of software history.”

The U.S. National Security Agency on Wednesday advised companies and government agencies to install the patch as quickly as possible and said it may be necessary to take down public-facing websites in the meantime, echoing similar calls from cybersecurity authorities in the U.K., Europe, and Japan. Government agency websites in countries including Finland and The Netherlands were taken down as a precaution Wednesday morning.