In the case of PHP, an open source code language that is used to power a big portion of the internet, AI has helped to identify severe security problems. The finding has caused a rush of online service operators to take down services and websites offline and develop measures to secure their systems.
The incident shows how AI is becoming an increasing issue for cybersecurity: defenders are using AI to find vulnerabilities in software faster, but when vulnerabilities become public, so too could those of the attackers.
It has been around for decades, and PHP has been a part of the web. But vulnerabilities in its code are now a real-world challenge for the speed of organisations responding to help uncover a problem that impacts so many websites, aided by artificial intelligence.
AI Helped Researchers Find Flaws That Had Stayed Hidden for Years
Advanced AI tools were used by the cybersecurity researchers to uncover the vulnerabilities. The researchers at Calif, along with OpenAI, made the first disclosure to PHP developers on August 11, 2026, according to Reuters. Later that month, security firm Wiz uncovered another vulnerability with the help of AI models, independently.
The discovery is noteworthy due to the fact that the vulnerabilities were present in PHP’s code for years. It took a complicated string of potential steps to prove how the flaws might be exploited, researchers said, and would have been hard for human researchers to follow. In some instances, AI can more effectively and rapidly analyse massive codebases, detect unusual behavior, and look for potential vulnerabilities than traditional manual techniques. This provides a huge new opportunity for cybersecurity teams to discover issues ahead of the perpetrators. But the same ability poses a big problem: attackers can also leverage AI to grasp newly identified vulnerabilities and design their attacks against unpatched systems.
As Security Teams Rushed to Act, Most Government Websites Went Offline
Several countries experienced government and other online services being shut down on 21st October 2026 as organisations scrambled to secure their vulnerable systems. In addition to the disruption in the Netherlands, it also affected services in Finland, Denmark and France, Reuters reports.
This was a precautionary reply. Going offline does not imply hackers have broken into a site; temporarily putting it offline will minimize exposure as security teams put in place updates and run security scans. The two PHP flaws were rated 9.2 out of 10 points each using a common rating system for evaluating software security flaws known as CVSS v4.0. They may have remote code execution capabilities, allowing an attacker to execute commands on a vulnerable server without having to log on to it first.
That can be lost data, stolen website pages, or a hacked server for the website owner. The first indication for visitors may just be a non-functioning website. If attackers obtained information from affected systems, potentially more serious consequences could result.
AI Is Changing the Race Between Security Teams and Hackers
The PHP incident is just one of the problems facing the cybersecurity industry. While AI can aid in vulnerability detection, it can also assist in the analysis of public data and identification of vulnerable systems, making it easier for attackers to learn more about the potential targets.
The PHP Foundation admitted that AI-powered research is raising the number of security reports that developers have to evaluate. It also emphasized that human engineers continue to have to assess the results, make complex technical decisions, and audit fixes.
The incident also calls into question the funding and specialist developers that open-source projects have on hand to quickly react to the rise in accessibility of vulnerability research with the advent of open-source and AI. The most obvious task for any website owner is to ensure that vulnerable PHP versions are updated; and that they are aware of any compromise and ensure that security measures are current. The greater message for the industry is that this needs to be accompanied by a more rapid, coordinated and empowered response.
This technology, which enabled the weaknesses to be exposed, may ultimately make the internet safer. However, that will rely on organisations addressing the issues before the attackers take advantage of it.
