AI-Discovered PHP Flaws Prompt Global Patch Effort

Artificial-intelligence agents uncovered critical vulnerabilities in PHP, the server-side language that powers roughly 70 % of websites where the language is known. The FBI’s cyber division warned that the flaws could enable remote code execution, raising the risk of data breaches and network compromise. Within hours of the public disclosure on Wednesday, the Cloudflare CEO reported “millions” of exploitation attempts. Government portals in Britain, Finland and Japan experienced partial or temporary outages as operators either applied patches or took sites offline to reduce exposure.

Associated Press

U.S. and European authorities issued urgent advisories urging immediate remediation. The PHP Foundation released patches and detailed upgrade instructions the same evening. OpenAI announced it had led a coalition of researchers, security providers and partners—including Wiz and Cloudflare—to prepare protections ahead of disclosure. A spokesperson for the British prime minister’s office said officials were working closely with OpenAI and international partners, while Japan’s prime minister urged administrators to install the patch promptly. Finnish officials confirmed that their main government site was partially restored after the disruption.

PBS News Hour

Cyber-security analysts emphasized the paradox of AI-driven discovery: speed in finding flaws can outpace the ability of organizations to patch them. Ismael Valenzuela of Arctic Wolf noted that the vulnerabilities had existed for years, but AI made them “exploitable” at scale. Raghu Nandakumara of Illumio warned that without control mechanisms, rapid AI findings create a “new kind of security problem.”

Associated PressPBS News Hour

• “READ MORE: Trump names national intelligence director Jay Clayton to lead a new federal AI task force "If it is difficult to apply the fix patch promptly, temporarily suspending websites and similar measures can be considered an effective way to reduce risk," Prime Minister Sanae Takaichi said.” — Prime Minister Sanae Takaichi

PBS News Hour

• “As significant as they are, these bugs are among several significant vulnerabilities we’ve already found and are working to fix, and we expect similar findings to increase sharply in the coming months,” — San Francisco-based OpenAI

Associated Press

• “There’s an important paradox here. We want AI to move quickly enough to find vulnerabilities humans might miss, while also making sure that increasingly autonomous systems operate within boundaries we understand and control,” — Raghu Nandakumara, vice president of industry Strategy at cybersecurity company Illumio

Associated Press

• “The faster AI becomes at finding weaknesses, the more important it becomes to think about what happens after those weaknesses are exposed, especially when organizations can’t immediately patch every affected system,” — Raghu Nandakumara, vice president of industry Strategy at cybersecurity company Illumio

Associated Press

• “The lesson isn’t that AI is inherently dangerous or inherently protective. It’s that speed without control creates a new kind of security problem.” — Ismael Valenzuela, of Arctic Wolf

Associated Press