Yesterday, October 21, the Internet faced one of the biggest crises of recent years. Two critical vulnerabilities appeared, almost out of nowhere, in PHP, the language used by millions of web pages around the world, and an international response was set in motion that affected many websites. According to OpenAI, its artificial intelligence helped uncover two flaws that had remained hidden for decades, but the response, rushed, understandably, has led to instability or inaccessible services.
Two vulnerabilities hidden for years
PHP is behind approximately 70% of websites (that is, more than 33 million sites), including all those created with WordPress. The flaws, worryingly present since PHP 5.4, which was released in 2004, allow an attacker to execute code on the affected servers and access sensitive information.
The discovery was made possible thanks to the work of Calif, a security company, and researchers from Google Wiz. The former used GPT-5.6 Sol, while at Wiz they used the models Google develops to detect vulnerabilities.
Together, AI managed to identify two problems that were especially hard to detect. While companies like Cloudflare, AWS, and Akamai took part in testing the first patches and prepared protective measures, the situation was evolving quickly: the priority is to update.
Updating now is the priority
The PHP Foundation has already released versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 that fix both flaws. Servers should be updated as soon as possible and, if that is not possible, to temporarily take affected websites offline.
While OpenAI warns about AI-powered attacks, this same technology also can improve security. In this case, the urgency of the situation has caused some disruption across the web, but all in all, the news is good.
