Security flaws exposed by AI puts websites in critical danger

Widely used website programming language PHP was found by AI to contain severe security flaws causing widespread shutdown of government and company websites across the world.

One of the cybersecurity firms that discovered the security flaws also estimated that about 70 percent of all websites are run in part by the PHP code, from online stores and news outlets to government services, it said.

The company called Wiz – owned by Google – said the flaws were found using Google’s Gemini 4 Argon and GPT-5.6 Sol; it called the flaws: “among the most severe vulnerabilities discovered in PHP, and arguably in software history”.

A fix for the security flaws was released on Wednesday, the U.S. National Security Agency (NSA) promptly told organizations to either update to the fix or pull systems offline.

The flaw would have allowed “attackers to get into your servers without any authorization, without any username or password,” according to Rahat Masood, senior lecturer in cybersecurity at the University of New South Wales.

“Once they are in the servers, they can do anything they want” — from stealing sensitive information to modifying website content — she said, adding that websites should “take it seriously.”

Only sites that run PHP on their own servers were exposed to the attack, however, with many large platforms being built on other programming languages could otherwise install the fix quickly, enabling them to stay online.

“If you run PHP, it is imperative that you update now,” the PHP Foundation said in a blog post with OpenAI calling it “one of the most impactful vulnerabilities in recent memory,” in a post on X.