AI uncovers PHP security flaws after years of delay

Artificial intelligence helped identify security flaws in the widely used PHP programming language, prompting an urgent update and website shutdowns around the world. DR reports that the PHP Foundation released an update on Wednesday to close the vulnerabilities.

Rumours about two security flaws began circulating online on Tuesday. Before the update was available, companies and governments took websites offline to prevent unauthorised access.

The PHP Foundation first found indications of the problem in 2024 while reviewing its codebase. Cybersecurity professor Jens Myrup Pedersen of Aarhus University said the organisation had limited resources at the time and faced difficulties fixing the issue without significantly affecting users. In a blog post on Wednesday, the Foundation described the delay as a structural failure.

In 2026, the Foundation began another review of its code, this time using AI, including language models from OpenAI and Anthropic. The review identified the same vulnerability. Pedersen said fixes can take time because the software runs on many systems and is used in many different ways, making it important to ensure updates do not cause outages or introduce new security problems.

PHP is used by about 70 per cent of websites whose programming language can be identified, according to Reuters. It also underpins WordPress, which runs about 40 per cent of all websites, including blogs, business sites, government portals, online shops and news sites.

Pedersen said AI can help find flaws more quickly, but hackers can use the technology to locate vulnerabilities faster too. He said he had bet another journalist a beer that a similar case would emerge within five years.