A critical vulnerability in PHP, the programming language used by a large proportion of the world’s websites, has highlighted how artificial intelligence (AI) is changing the cybersecurity landscape by turning previously impractical attacks into achievable threats.
the vulnerability had been flagged by security researcher Stefan Esser in July 2004, but the warning received limited attention for years. Related issues were identified in 2020 and 2024, although the underlying problem remained unresolved.
Researchers have now demonstrated how AI can help turn a theoretical vulnerability into a working exploit in just days, prompting a security update and renewed warnings about the risks facing internet infrastructure.
The disclosure was announced alongside a security update intended to address the problem.
AI Changes the Economics of Cyberattacks
For decades, exploiting certain software vulnerabilities required extensive technical expertise, repetitive coding and painstaking experimentation. Although security researchers understood that some flaws could potentially be exploited, developing a reliable attack could take substantial time and resources.
AI is changing that equation by automating much of the work.
Fuel Cells Gain Ground as US AI Data Centres Face Power Shortages
On July 30, researchers at AI security company Calif, working with OpenAI’s Patch the Planet security initiative, began examining PHP using a large language model. The researchers initially did not expect to uncover a critical vulnerability.
By August 1, they had identified a method for exploiting PHP vulnerabilities. Further discoveries followed, while researchers at Google-backed cybersecurity company Wiz subsequently identified additional exploits.
Wiz described the vulnerability as one of the most severe in software history.
Vyas Sekar, a professor of computer engineering at Carnegie Mellon University, said the discovery should serve as a warning to the cybersecurity industry.
“The security industry has long been warning about the coming security apocalypse, because AI can do these things very, very quickly – better than humans,” Sekar said. “This may be the first of many. This is a wakeup call.”
The findings have raised concerns that AI could help attackers exploit vulnerabilities that previously remained impractical to weaponise because of the effort involved.
Why the PHP Vulnerability Matters
PHP is widely used to build and operate websites, web applications and server-side systems. A vulnerability affecting the language can therefore have implications for a broad range of online services.
The flaw involved how PHP handled requests and memory under certain conditions. When a server ran out of memory and crashed, stale data could remain behind, potentially allowing an attacker to expose information or execute malicious code.
Researchers found ways to trigger these conditions and bypass safeguards that had made exploitation difficult.
One technique exploited a mismatch between how PHP measured compressed files and their decoded contents. This could allow files through checks before they expanded in a way that enabled an attack.
Another approach used deeply nested file structures to overwhelm PHP’s directory-handling processes and trigger memory failures.
The key breakthrough was not simply identifying a weakness, but finding practical methods to exploit it. AI helped researchers automate the tedious experimentation needed to reach that point.
Why Traditional Security Defences May No Longer Be Enough
The discovery has challenged the idea that a vulnerability can remain relatively safe simply because exploiting it requires too much time and effort.
Nick Rogers, chief executive of Fieldwork AI, described this approach as “security by exhaustion” and argued that it is no longer a dependable safeguard.
Researchers at Calif also noted that they did not rely on specialised AI models unavailable to the public. This raises concerns that similar capabilities could be accessible to a much wider range of potential attackers.
The growing availability of AI tools has already attracted attention from governments and cybersecurity organisations.
In June, Anthropic paused the deployment of its Mythos model amid concerns about its ability to discover software vulnerabilities and identify attack methods. The episode illustrated the potential national security implications of advanced AI-assisted cybersecurity capabilities.
Experts warn that the PHP case may be part of a much broader trend, as AI makes it easier to identify and exploit weaknesses across widely used software systems.
Security Patches Do Not Eliminate Every Risk
Although a patch has been released for the PHP vulnerability, cybersecurity specialists warn that the threat may persist.
Many organisations continue to operate outdated PHP versions, leaving systems exposed if they do not install applicable security updates.
Adam Meyers, vice president of counter adversary at CrowdStrike, said attackers do not necessarily need to discover a vulnerability themselves if they can exploit it after it becomes public.
“Bad guys don’t need to find the vulnerability first – they can weaponize it after the fact,” Meyers said.
According to Cloudflare, thousands of exploit attempts were observed in the hours before the public announcement, following an apparent leak about the vulnerability.
The episode highlights the importance of coordinated vulnerability disclosure, in which researchers and software maintainers work to prepare fixes before detailed information about a flaw becomes widely available.
However, even coordinated disclosures cannot guarantee that every affected system will be updated promptly.
Can Businesses Move Away From PHP?
Replacing PHP across existing websites and applications would be expensive and technically challenging.
Many organisations have built complex systems around the language over several years or decades. Migrating them to another technology could require extensive redevelopment, testing and operational changes.
Meyers noted that moving away from PHP would involve rebuilding applications rather than simply switching between services.
OpenAI’s recommendations following the disclosure emphasised developing more secure software and addressing vulnerabilities systematically. However, organisations with large legacy systems face the additional challenge of identifying and repairing weaknesses in applications already in production.
Security experts say businesses must reconsider how they assess software risk, particularly as AI reduces the time and expertise required to turn vulnerabilities into working attacks.
Madhu Shashanka, co-founder of Concentric AI, argued that organisations should treat every part of their operations as a potential security risk.
“Everything is a potential vulnerability,” Shashanka said. “Every business operation is a high-stakes operation.”
What Businesses and Website Owners Should Do
The PHP incident reinforces several practical cybersecurity priorities:
- Apply security updates promptly: Identify affected PHP versions and install the appropriate vendor-recommended patches.
- Audit outdated systems: Review servers, websites, plugins and third-party components for unsupported or vulnerable software.
- Monitor for suspicious activity: Investigate unusual server behaviour, unexpected processes, abnormal memory consumption and possible data exposure.
- Strengthen access controls: Restrict administrative privileges and isolate critical systems to reduce the potential impact of a successful attack.
- Maintain tested backups: Keep secure backups and regularly verify that systems can be restored following a security incident.
- Use ongoing vulnerability assessments: Combine automated scanning with expert security reviews to identify weaknesses before attackers exploit them.
Organisations should also establish clear processes for emergency patching and incident response, rather than relying solely on routine maintenance schedules.
A Turning Point for Cybersecurity
The PHP vulnerability illustrates how AI can accelerate both defensive security research and malicious exploitation. A flaw that remained difficult to exploit for years can become a practical threat when AI automates the work required to develop an attack.
The challenge now extends beyond PHP. As AI-assisted tools become more capable and accessible, organisations may need to assume that previously obscure vulnerabilities can be discovered and exploited much faster than before.
For website owners, technology companies and security teams, rapid patching, continuous monitoring and stronger software development practices are becoming increasingly important in protecting digital infrastructure.
