AI uncovers 'most severe' flaws in PHP, the software running most of the web

Developers of PHP, the platform used by sites including Wikipedia and major digital shopping services, have rolled out patches to fix vulnerabilities that had been hidden in the software for years, the BBC reports.

The flaws were found using technology from OpenAI, which was used in the discovery. Cyber-security firm Wiz described the issue as the "most severe" ever detected, while OpenAI called the discovery "one of the most impactful security issues in recent memory."

Governments and cyber-security agencies around the world are now working to contain the threat, which touches core internet infrastructure relied on by billions of web users. The BBC's technology correspondent Joe Tidy reported on how the AI-assisted discovery emerged and the scale of the risk it exposed.

Analysis

Why This Matters

PHP sits behind more than 70 per cent of websites, so a vulnerability in the platform is effectively a vulnerability in a large slice of the web itself
The discovery marks a milestone for AI in security: the flaws eluded human reviewers for years until machine-learning tools found them
Patching is only half the battle; the risk persists until millions of site operators actually update their systems

Background

PHP is one of the oldest and most widely used programming languages for building websites, running quietly on a large share of the world's web servers. Because so many sites depend on it, a single weakness can cascade across industries, from news outlets to online retailers. The use of AI to hunt for software flaws is a fast-growing area of security research, with tools increasingly used to scan vast codebases for weaknesses that humans miss.

Key Perspectives

Security researchers at Wiz: They called the finding the most severe ever detected, signalling that the vulnerabilities touch technology at the heart of the internet.

OpenAI: It framed the discovery as one of the most impactful security issues in recent memory, casting AI as a defensive tool rather than just a source of new risks.

Site operators and administrators: The practical burden now falls on the millions of organisations running PHP to apply the patches quickly, a process that typically takes weeks or months across the wider web.

What to Watch

The speed with which patches reach the most exposed sites, and whether any active exploitation is reported in the meantime
Statements from cyber-security agencies on the severity level and their guidance to web administrators
Whether AI-assisted reviews are extended to other widely used platforms, potentially surfacing more long-hidden flaws

Checked

11 claims in this story checked against 1 source: 6 supported.

Show each claim

Partly supportedAI uncovered the “most severe” flaws in PHP.BBC News: “Cyber-security firm Wiz described the issue as the "most severe" ever detected”
Partly supportedPatches were rushed out for the PHP vulnerabilities.BBC News: “Developers of the PHP platform - which powers more than 70% of websites, including Wikipedia and digital shopping sites - rolled out patches to fix the vulnerabilities”
SupportedThe vulnerabilities had lurked in PHP for years.BBC News: “rolled out patches to fix the vulnerabilities that had been lurking in their software for years.”
Partly supportedAI uncovered critical security vulnerabilities in PHP.BBC News: “Governments and cyber-security agencies around the world are scrambling to contain a massive flaw in internet technology, after AI discovered issues that could be exploited by hackers.”
SupportedPHP powers more than 70 per cent of the world’s websites.BBC News: “the PHP platform - which powers more than 70% of websites, including Wikipedia and digital shopping sites”
SupportedGovernments and cyber-security agencies around the world are scrambling to contain the risk.BBC News: “Governments and cyber-security agencies around the world are scrambling to contain a massive flaw in internet technology”
SupportedHackers could exploit the risk.BBC News: “after AI discovered issues that could be exploited by hackers.”
Partly supportedPHP is used by Wikipedia and major digital shopping services.BBC News: “including Wikipedia and digital shopping sites”
SupportedOpenAI technology was used to find the flaws.BBC News: “OpenAI, whose technology was used to find the flaws”
SupportedWiz called the issue “the most severe” ever detected, and OpenAI called the discovery “one of the most impactful security issues in recent memory.”BBC News: “Cyber-security firm Wiz described the issue as the "most severe" ever detected, while OpenAI, whose technology was used to find the flaws, called the discovery "one of the most impactful security issues in recent memory".”
Not in the sourcesThe threat touches core internet infrastructure relied on by billions of web users.