Researchers using AI discovered critical vulnerabilities in PHP, prompting millions of attempted hacks across the internet.

Recently discovered vulnerabilities in the open-source programming language PHP forced website owners to immediately patch their sites or take them offline to ensure safety. Human researchers participating in an initiative by OpenAI and Wiz found the bugs. PHP, officially known as Hypertext Preprocessor, is a decades-old language that powers content management systems across roughly 70% of websites, including those using WordPress and Drupal.

Following the disclosure, Cloudflare CEO Matthew Prince reported millions of attempted hacks targeting what has been called PHP2Shell. Additionally, Amazon observed attempts to exploit the vulnerability on its decoy honeypot network before the public announcement. The incident highlights the risks of relying on foundational open-source technology that underpins millions of websites globally.

Because the severe vulnerability has existed for decades, the simultaneous need to announce the flaw and urge immediate patching triggered a rushed race among hackers. Some websites and government entities chose to shut down entirely rather than patch their sites, raising concerns about permanent link rot and the accessibility of older digital history.

Observers note that widespread access to advanced language models and AI agents could make finding and exploiting such deep infrastructure vulnerabilities increasingly common.