AI Found a PHP Time Bomb, and the Internet Is Racing to Defuse It
AI Found a PHP Time Bomb, and the Internet Is Racing to Defuse It
The alarm began with a stark assessment: PHP, a language used by as much as 70% of websites, contained a critical weakness that could let attackers disrupt or seize control of affected systems.
Researchers at Calif, using OpenAI’s GPT-5.6 Sol, identified exploits before they were known to be abused, while Wiz independently uncovered the issues. OpenAI said the work fed into its “Patch the Planet” initiative and released a tool intended to help developers identify vulnerable PHP versions.
By Wednesday, disclosure turned that technical finding into a global operational emergency. Governments and organizations in Europe and the United States temporarily took sites offline while applying updates. The risk was unusually severe: an attacker could potentially take over a vulnerable web server without a password, then tamper with sites or steal sensitive data. Some services linked to Wikipedia and 4chan were among those taken down while operators patched.
The response reflected both relief and dread. Defenders had received a head start, but OpenAI warned that the same AI capabilities can help attackers build exploits faster. Wiz called the findings “among the most severe vulnerabilities discovered in PHP, and arguably in software history.”
That window may already be narrowing. Cloudflare CTO Dane Knecht said, “We are seeing early attacks emerging and are updating mitigations as new vectors show up.” Japan’s prime minister, Sanae Takaichi, issued an urgent call for action, while OpenAI warned that stronger models could uncover still more failures. The PHP episode is therefore more than a patching crisis: it is an early test of whether internet defenders can move at AI speed.
Write a comment