PHP's Critical Flaw: What Happened and How to Secure Your Site Now
AI models helped uncover two critical PHP flaws rated 9.2/10 severity. Here's the timeline, government response, and how to protect your site today.
What happened with the PHP vulnerability
Security researchers, aided by AI models, found two critical flaws inside PHP, the engine that runs an estimated 70% of websites worldwide, including most WordPress sites. The PHP team rated both flaws 9.2 out of 10 for severity. Under the right conditions, an attacker could execute code on a server remotely, without a password or an account, potentially reaching files, databases, and everything else behind that server. The fix shipped October 21 after details leaked early, triggering alerts from the NSA, the FBI, the UK’s National Cyber Security Centre, and the Japanese Prime Minister.
TL;DR
- Two critical PHP vulnerabilities, each scoring 9.2 out of 10 in severity, were discovered with help from AI models from OpenAI, Wiz, and a security firm called Kaliff, then patched on October 21.
- The flaws allowed remote code execution without authentication, meaning an attacker didn’t need a login or password to potentially take over a server running vulnerable PHP.
- Government cybersecurity agencies in the US, UK, Netherlands, Finland, France, Australia, and Japan issued urgent warnings, and some took their own services offline as a precaution.
- Analysis of millions of PHP sites found that roughly 46% run end-of-life versions that no longer receive security updates, meaning a large chunk of the internet may stay exposed indefinitely.
- Separately, an Indian certificate authority called eMudhra was found using a private key as weak as the number 4 instead of a cryptographically secure 115+ digit number, compromising trust certificates for roughly 18 months.
- Hackers have already used AI models including Claude, Grok, and Kimi to automate attacks against roughly 400 banks, suggesting AI-assisted offense is scaling alongside AI-assisted defense.
- The people flagging this loudest argue small businesses, unmaintained sites, and institutions outside major tech ecosystems face the highest risk, since they’re slowest to patch and least likely to know they’re exposed.
Built like a system. Not vibe-coded.
Remy manages the project — every layer architected, not stitched together at the last second.
How was the PHP flaw discovered?
The discovery didn’t come from one lab working alone. According to OpenAI, researchers at a security company called Wiz found an early version of the problem with AI assistance and reported it to the PHP team back in August. Separately, researchers at Kaliff used OpenAI’s model (referred to in coverage as GPT 5.6 Codex/Soul) to find one of the flaws independently. OpenAI’s own team then found a more complete version of the bug in September. Three separate groups, using AI tools, converged on the same underlying weakness within weeks of each other.
The technical root involved memory corruption during PHP’s cleanup process, specifically around what’s described as “interruption points,” the moments when PHP runs out of memory and has to clean up mid-operation. Researchers used AI models to surface the first fatal out-of-memory error and then chain together enough of these interruption points to build a working remote code execution exploit against WordPress specifically. One researcher reportedly had the AI generalize the technique into a reusable “skill” file, essentially turning a one-off discovery into a repeatable method for hunting similar bugs elsewhere in the codebase.
This matters because it changes the economics of vulnerability hunting. A human researcher working alone tests one hypothesis at a time and gets tired. An AI model can run many hypotheses in parallel, never gets bored, and can reuse accumulated technique across a huge search space. That’s a big part of why multiple independent teams found overlapping flaws in a short window instead of one lucky researcher stumbling onto it.
Why did governments respond so aggressively?
Once the flaw’s details leaked ahead of the planned, coordinated release, the PHP Foundation moved up its fix and shipped it on October 21. That leak compressed what should have been a quiet, controlled patch rollout into a scramble. Cybersecurity agencies don’t usually move this fast or this publicly, but the math here is blunt: a huge share of global web infrastructure runs PHP, and a flaw this severe, if left unpatched even briefly, gives attackers a wide-open door into servers that hold customer data, financial records, and credentials.
The NSA told organizations to prepare for an emergency update and, if they couldn’t patch immediately, to take affected systems offline until they could. The FBI’s cyber division issued a “patch and hunt” alert, telling organizations to fix the hole and then actively check whether someone had already gotten in. The UK’s NCSC echoed the same guidance. Japan’s Prime Minister posted directly on social media asking site operators to check their PHP usage and apply the fix that night. The Netherlands, Finland, France, and Australia reportedly took some of their own government services offline temporarily. The Dutch national cybersecurity center took its own website down as a precaution, which tells you how seriously the technical community treated the window between disclosure and patching.
Cloudflare, which sits in front of a large share of the web’s traffic, rolled out emergency protections across all of its customer tiers, including free accounts, and reported seeing early attack attempts within hours of the leak.
Why does nearly half the internet stay exposed?
The patch only covers PHP versions still officially supported. Older, “end-of-life” versions don’t get the fix at all. Analysis of millions of PHP-powered websites found that a large share, cited as around 46%, run one of these unsupported versions. That means a meaningful fraction of the web can’t simply “update” its way out of this, because nobody is maintaining the underlying software anymore.
This is the structural problem underneath the headline. The sites most likely to stay vulnerable are small online shops, old forums, community sites, local business pages, and booking systems set up once and never touched again. Their owners aren’t reading NSA bulletins or following cybersecurity accounts on social media. They may never learn this happened. If you created an account on a small site years ago and reused a password anywhere else, that old, unmaintained site is now a plausible route into your email, your social media, or your bank login, even though you did nothing wrong yourself.
What should you actually do right now?
If you run a website on PHP or WordPress, update it immediately and confirm the patch actually applied, don’t assume an update notification means the fix is live. If you’re on shared hosting or a managed platform, check with your host directly rather than assuming they handled it automatically.
For everyday browsing and account security, the practical steps are less dramatic but more durable:
Run full antivirus and anti-malware software on every device, including phones, not just your computer. Keep your browser, operating system, and apps updated, and don’t delay those updates right now. Turn on ad blocking and disable autoplay for active content. Be skeptical of links in text messages and emails for the next while, since phishing attempts tend to spike after events like this. Use two-factor or multi-factor authentication everywhere it’s offered, ideally with an authenticator app or hardware key rather than SMS alone. And if you’ve reused the same password across multiple old accounts, this is a reasonable moment to start changing them, starting with your email and any financial accounts, since those are the ones that open up everything else if compromised.
None of this guarantees safety. If a small, unmaintained site you signed up for years ago already got breached, your old password and personal details may already be circulating. The realistic move is to assume some exposure already happened and reduce how much damage it can do by not reusing credentials anywhere important.
Is this really AI’s fault, or did AI help?
Both, in a sense. AI models helped find the vulnerability before attackers did, which is what security researchers call a “defender’s window,” the gap between discovery and exploitation where the good guys get to fix things first. OpenAI described this discovery as one of the most impactful vulnerability findings in recent memory and said it expects similar AI-assisted discoveries to increase sharply in coming months, suggesting this isn’t a one-off event.
Everyone else built a construction worker.
We built the contractor.
One file at a time.
UI, API, database, deploy.
But the same capability cuts both ways. Separately from the PHP story, attackers have already used AI models including Claude, Grok, and Kimi to automate a coordinated attack against roughly 400 banks. The tools that help researchers find and patch flaws faster are the same category of tools that let attackers scale their own operations. The defender’s window only works if the responsible disclosure process holds, and in this case it didn’t fully hold, since details leaked before the planned fix.
Frequently Asked Questions
What is the PHP vulnerability everyone is talking about?
It’s a pair of critical security flaws found inside PHP, the software that powers an estimated 70% of websites including most WordPress sites. Both flaws were rated 9.2 out of 10 in severity and could let an attacker remotely execute code on a server without needing a password or login.
Do I need to do anything if I don’t run a website?
You should still update your devices, apps, and browser, enable two-factor authentication, and avoid reusing passwords across sites. Even if you never touch code, your personal data likely lives on small websites that may stay unpatched for a long time, and that data can resurface in leaks or phishing attempts.
How was this vulnerability actually found?
Multiple research teams, including Wiz, OpenAI’s own researchers, and a firm called Kaliff, used AI models to probe PHP’s code for weaknesses, independently converging on overlapping flaws tied to memory cleanup errors. AI’s ability to test many hypotheses quickly and without fatigue sped up a process that traditionally took much longer with human researchers alone.
Why are so many sites still vulnerable after the patch?
The official fix only applies to PHP versions still under active support. A large share of websites, estimated around 46% in one analysis, run older, end-of-life versions that no longer receive security updates at all, leaving them exposed regardless of the patch.
Is my information already compromised?
There’s no way to know for certain without specific breach notifications, but the realistic assumption is that some older, unmaintained sites you’ve used in the past could already be exposed. Changing reused passwords and enabling multi-factor authentication on your important accounts is the most practical defense available right now.
