Two critical PHP flaws hit sites that make up about 70% of the web

The PHP organization and the FBI's cyber division warned on Wednesday about two critical vulnerabilities in PHP. The news was first reported by The Economic Times. Agencies and companies rushed to respond. PHP powers about 70% of websites, and the flaws could let attackers get unauthenticated access to sites running it.

The Economic Times reported that humans found the flaws first. AI agents then helped identify how they could be exploited and validated the fixes. OpenAI led a coalition on the work over two months. Wiz researchers also used AI on their own to identify the vulnerabilities. The flaws had been known since at least 2024. Disruption was reported in government sites in the UK, Finland and Japan.

The PHP Foundation admitted fault for the delay. It said: "We won't pretend otherwise: the delay was a structural failure, caused by both the security team's decision process and its lack of resources." Earlier, a security team had built competing fixes, each with downsides. With no practical exploit seen, progress stalled. Some sites may still be down because several patches exist for different software and need testing.

James Sullivan, the London-based Royal United Services Institute's director for cyber and tech, said: "We've actually seen quite a decent use case here where AI can discover some critical vulnerabilities and then the community can come together to remediate them,". Charl van der Walt, who leads security research at Orange Cyberdefense, said: "It's not quite as easy for defenders as it is for attackers". He also pointed to "early tremors".