Artificial intelligence has found critical security flaws in a major programming language called PHP, with many websites taken offline Thursday as organisations worldwide scramble to fend off would-be hackers.
asserted
organisations → find → hackers
As AI’s fast-advancing capabilities fuel concern over the increased risk of cyberattacks, here are some questions and answers about the situation:
asserted
questions → advance → situation
What is PHP and how widely used is it?
asserted
it → use → ?
Created in the early 1990s, PHP is a computer programming language that helps run an estimated 70 per cent of the world’s websites.
asserted
that → create → websites
It is “a backbone of the web”, according to security firm Wiz Research, which says it used AI to find vulnerabilities hidden in PHP for more than a decade.
uncertain
it → accord → decade
PHP — a name that originally stood for Personal Home Page — underpins popular web design platforms, meaning the flaws could allow hackers to break into various sites, from online stores to government services.
uncertain
hackers → stand → services
A fix was released Wednesday, with the PHP Foundation telling the tech departments of companies and organisations around the world: “If you run PHP, it is imperative that you update now.”
That has resulted in a slew of apps and websites — from the Paris police website to a Pokemon sleep tracker — going dark as developers work to protect their underlying code from hacks.
asserted
developers → release → hacks
How did AI find the flaws?
asserted
AI → find → flaws
Cutting-edge AI models, such as those from US giants OpenAI and Google, were used by Wiz and other groups to uncover PHP’s weak spots in August.
asserted
models → cut → August
This was kept under wraps while a fix was developed.
asserted
fix → keep → wraps
OpenAI called the flaws “one of the most impactful vulnerabilities in recent memory”, adding that it “marks a new phase, where AI can find security bugs with internet-scale impact”.
asserted
AI → call → impact
Separately to Wiz, security firm Calif found the flaws as part of an OpenAI-funded audit of PHP’s code.
asserted
Calif → find → code
“The trouble with tools like AI is that the moment all the information’s out there, people can weaponise it very, very quickly,”
Steve Kerrison, senior lecturer in cybersecurity at the Singapore campus of James Cook University, told AFP.
“That’s why everybody’s acting with such urgency to respond to this issue.”
asserted
everybody → ’ → issue
Have sites already been hacked?
asserted
sites → hack → ?
“Taking websites offline does not necessarily mean they have been hacked.”
asserted
they → take → websites
“It can be a responsible measure to protect systems while security updates are applied,” said Dimitrios Salampasis from Australia’s Swinburne University of Technology.
asserted
Salampasis → protect → Technology
So far “the evidence that security researchers are seeing is that nobody was actively performing attacks using the techniques available”, Kerrison said.
asserted
Kerrison → see → techniques
Larger institutions, from government agencies to news outlets, should be able to fix their websites relatively quickly — but others may be left vulnerable.
uncertain
others → fix → websites
“There are sites, systems and people out there who will have no idea about this and still won’t for days, weeks and months,” Kerrison warned.
asserted
Kerrison → be → days
That may include user-run blogs that could be used to spread computer viruses, spam people or distribute malicious content.
uncertain
that → include → content
A data breach could affect customers in the future if their personal information is used in so-called “phishing” attacks, where someone is tricked into revealing their password to an online service.
uncertain
someone → affect → service
The complex and interlinked nature of online systems, which often use third-party interfaces, means some vulnerabilities could remain even after the problem is fixed.
uncertain
problem → use → interfaces
If the third parties use PHP, “then even though you patched yourself… you’re still unsecure”, said Rahat Masood, senior lecturer in cyber security at the University of New South Wales, Sydney.
asserted
Masood → use → Wales
PHP isn’t everything, however — strong cybersecurity measures should include several layers of defences, Kerrison said.
asserted
Kerrison → include → defences
Header image: Unplugged LAN network cables at a computer server, as cyber agencies warn that websites may be taken offline while PHP prepares a critical fix, in Berlin, Germany, on October 21, 2026.
uncertain
PHP → unplug → October
The Aporia
