AI-discovered PHP vulnerability triggers global scramble after early leak

Chainguard CEO breaks coordinated disclosure embargo, forcing government websites offline

By LineZotpaper AI staff

Published24 October 2026

Read Time3 min

A critical vulnerability in the PHP programming language, discovered using AI tools, sparked a worldwide cybersecurity emergency this week after a company prematurely released information about the flaw, leaving much of the web exposed. Governments across Europe, the U.S., the U.K., Australia and Canada issued urgent warnings and took websites offline as a precaution, though no major hacking damage was immediately apparent.

The exposure of the PHP vulnerability, which is estimated to be integrated into about 70% of the web, has brought to life months of warnings about how AI-powered tools could cause widespread damage. The flaws were discovered through a months-long process coordinated by OpenAI using AI tools, and the incident unfolded over 72 hours, showing how easily cybersecurity processes can break down.

The chain reaction was triggered when Chainguard CEO Dan Lorenc released information about the bug ahead of the planned disclosure time, breaking an embargo set up to allow time for a fix. In a LinkedIn post, Lorenc apologized, but in an interview with POLITICO he said he shared the information because the flaw was already being exploited. Others disputed that claim, but Lorenc said he believed he had seen enough evidence to invalidate the embargo, conceding that the evidential threshold in coordinated cyber defense systems is a "grey area."

The PHP Foundation said in a statement that Chainguard "unilaterally broke the embargo," which "disregarded weeks of work by many parties toward a coordinated disclosure." Executive director Elizabeth Barron told POLITICO the foundation was "disappointed" but hoped to "rebuild trust with them in the future to ensure we can continue to collaborate effectively."

After the leak, confusion spread. Government bodies and private companies chose to temporarily shut down their websites rather than risk breaches. Cloudflare CEO Matthew Prince said on X that it had seen "millions" of attempts to exploit the flaw, with the number rising rapidly after the public announcement. Amazon's cloud division said the flaw is "now being broadly exploited in the wild."

A senior U.S. government cyber official said federal authorities were overwhelmed, dealing not only with the PHP flaws but also with bugs in node.js, Fortinet, GitHub and Oracle. "The fire department is fighting multiple fires at once," the official said, adding that these are "all one-story structures on fire, which the fire department deals with all day, every day."

OpenAI said more vulnerabilities are coming, noting in a statement that these bugs "are among several significant vulnerabilities we've already found and are working to fix, and we expect similar findings to increase sharply in the coming months."

Cyber agencies across Europe warned of the transformed threat landscape. Matthijs van Amelsfort, head of the Dutch cybersecurity agency, said that since the arrival of frontier AI models, "this will be the trend." Thomas Caspers, vice president of Germany's cyber agency BSI, said the recommendation to take websites offline was a "drastic measure" that would not have been taken a few years ago, but AI had made it necessary. At the same time, Caspers noted that his agency has not seen any successful exploitation of the flaw, saying it "seems a little bit more complicated than expected to exploit."

The incident has underscored both the promise and peril of AI in cybersecurity: while AI can uncover hidden flaws, it also accelerates the race between defenders and attackers. Agencies are urging organisations to patch their systems immediately.

Analysis

Why This Matters

The AI-powered discovery and exploitation of vulnerabilities represents a new reality for cybersecurity, with the potential for widespread damage at unprecedented speed.
The breakdown of the coordinated disclosure process shows how easily established protocols can fail under pressure, leaving systems exposed.
As AI tools find more flaws, the scale of patching required may overwhelm defenders, especially when multiple critical vulnerabilities emerge simultaneously.

Background

The PHP programming language powers a large portion of the web, making vulnerabilities in it especially consequential. Coordinated disclosure is a longstanding practice in cybersecurity: researchers and companies that find flaws share them confidentially with agencies and vendors before public release, allowing time for fixes to be developed. The process relies on trust and agreement on embargoes. In April, Anthropic unveiled its Mythos AI model, and other frontier models from OpenAI and others followed, raising fears that AI would accelerate vulnerability discovery. This week's incident marks the first major real-world example of AI-discovered flaws triggering a global response.

Key Perspectives

Dan Lorenc (Chainguard CEO): Said he broke the embargo because the flaw was already being exploited, though others disputed that, and described the evidential threshold as a "grey area." Elizabeth Barron (PHP Foundation): Called the early release a unilateral breach that disregarded weeks of work, expressing disappointment but a desire to rebuild trust. Matthew Prince (Cloudflare CEO): Reported seeing millions of exploit attempts, with numbers escalating rapidly after the public announcement. OpenAI: Said the PHP flaws are among several significant vulnerabilities already found and that similar findings will increase sharply in coming months. Matthijs van Amelsfort (Dutch cybersecurity agency): Said the job of keeping systems safe has been transformed by AI and that this trend is now happening. Thomas Caspers (German BSI): Noted that the drastic step of taking sites offline was necessary due to AI, but that successful exploitation has not yet been observed. Senior U.S. government cyber official: Said federal authorities are overwhelmed, fighting multiple fires including bugs in other software.

What to Watch

Whether any hackers successfully exploit the PHP vulnerability to take control of websites or steal data in the coming days.
The pace of further AI-discovered vulnerabilities announced by OpenAI and other AI firms.
How the cybersecurity community responds to the breakdown in disclosure trust and whether embargo protocols are strengthened or revised.

Sources

Inside the cyber flaw scramble that brought the AI threat to life · Politico Europe

Checked

12 claims in this story checked against 1 source: 7 supported.

Show each claim

SupportedThe PHP vulnerability was discovered using AI and triggered a global scramble after an early leak.Politico Europe: “The decision by a cybersecurity company on Wednesday to prematurely release information about a flaw in the popular PHP computer programming language left much of the web exposed to hackers, triggering a panic”
Partly supportedChainguard’s CEO broke the coordinated-disclosure embargo.Politico Europe: “Then, according to the PHP Foundation, Chainguard “unilaterally broke the embargo,””
Partly supportedThe CEO’s embargo breach forced government websites offline.Politico Europe: “After the leak— which meant information about the bugs was in the open before the fix was ready — confusion quickly ensued, with government bodies and private companies choosing to temporarily shut down their websites rather than risk potentially damaging breaches”
Partly supportedThe vulnerability was critical and discovered using AI tools.Politico Europe: “The vulnerabilities, he added, are “about as serious as it gets for the web.””
Partly supportedGovernments across Europe, the U.S., the U.K., Australia and Canada issued urgent warnings.Politico Europe: “The flaws in PHP, discovered using AI tools through a months-long process coordinated by OpenAI, caused cyber agencies across Europe, the U.S., the U.K., Australia and Canada to post urgent warnings Wednesday.”
SupportedNumerous governments took websites offline as a precaution.Politico Europe: “Numerous governments took websites offline as a precaution.”
SupportedNo major hacking damage was immediately apparent.Politico Europe: “While no major hacking damage was immediately apparent, the way the incident unfolded over 72 hours showed how easily cybersecurity processes can break down”
SupportedThe vulnerability is estimated to be integrated into about 70% of the web.Politico Europe: “a coding language estimated to be integrated into some 70% of the web.”
SupportedThe flaws were discovered using AI tools through a months-long process coordinated by OpenAI.Politico Europe: “The flaws in PHP, discovered using AI tools through a months-long process coordinated by OpenAI”
SupportedThe incident unfolded over 72 hours.Politico Europe: “the way the incident unfolded over 72 hours showed how easily cybersecurity processes can break down”
SupportedLorenc said he shared the information early because the flaw was already being exploited.Politico Europe: “Lorenc said he’d shared the information ahead of time because the flaw was already being exploited.”
Partly supportedThe PHP Foundation said Chainguard “unilaterally broke the embargo,” disregarding weeks of coordinated-disclosure work.Politico Europe: “Then, according to the PHP Foundation, Chainguard “unilaterally broke the embargo,” which “disregarded weeks of work by many parties toward a coordinated disclosure.””