By Sanjay Dubey
On October 21, several government websites and online services around the world went offline. Not because hackers had broken into their systems, but because the organisations running them had deliberately taken them offline. They feared hackers might soon find a way in.
The reason was two serious security flaws in a programming language called PHP. Most internet users have probably never heard of it. Yet it works behind the scenes on a huge number of websites we visit every day.
In India, the government’s cybersecurity agency, CERT-In, identified around 60,000 potentially vulnerable websites, including 303 belonging to government bodies, public-sector organisations and critical sectors.
What made this incident particularly interesting was how weaknesses that had existed in PHP for more than a decade suddenly became such a serious threat.
Artificial intelligence played an important role in this. It helped security researchers uncover these flaws and find ways to exploit them. AI also helped them test possible fixes. But developing, testing and coordinating the release of those fixes took time. Before the fixes could be released, information about the vulnerabilities began to leak, raising fears that hackers might exploit them before websites could be secured. That led several websites to go offline as a precaution.
It also forced PHP’s developers to bring forward the release of security updates from October 22 to October 21. The seriousness of the threat was also evident in the response of Cloudflare, a major content delivery network (CDN), which developed its own protective measures and deployed them ahead of the official release.
To better understand why this caused so much alarm, let’s first look at what happens when we visit a website.
When we check our bank balance, read a news article or shop online, we click something, and the website responds. It might check our password, display information or process a payment.
Much of this work happens on computers called servers, and PHP is one of the programming languages that helps them do it. Its importance to the internet can be judged by the fact that around 69% of websites whose server-side programming language is known use PHP.
So what exactly was wrong with it?
Researchers discovered that under certain conditions, specially designed requests could trick PHP into doing two things it was not supposed to do.
First, it could expose private information that visitors were never supposed to see. Second, it could allow an outsider to take control of the server and make it carry out unauthorised tasks.
Now imagine a PHP-based government portal holding confidential records. An attacker who successfully exploited these vulnerabilities could potentially steal or alter that information, or install malicious software on the server without needing login credentials.
That is why the two flaws, collectively called PHP2Shell, were considered extremely serious, each receiving a critical security severity score of 9.2 out of 10.
. . .
Software vulnerabilities are nothing new. Even carefully written programs can contain mistakes. Some are discovered and corrected quickly. Others, like those found in PHP, can remain unnoticed for years.
What is changing in the age of AI is our ability to discover these weaknesses and, more importantly, figure out how to exploit them.
According to the PHP Foundation, which supports PHP’s development, one of the flaws in PHP was identified as early as 2024. However, because no one had demonstrated a way to exploit it at the time and the team had limited resources, work on fixing it was repeatedly delayed.
Then, in August and September 2026, researchers from Calif, OpenAI and Google’s cybersecurity company Wiz independently discovered serious weaknesses in PHP and ways to exploit them. Advanced AI models, such as GPT-5.6 Sol and Gemini 4 Argon, helped them make these discoveries in such a short time. They reported their findings to the PHP project’s security team.
These discoveries made fixing the vulnerabilities an urgent priority. Any further delay increased the risk that the researchers’ findings could leak and fall into the hands of hackers. But there was another challenge. Preparing and releasing security updates of this kind requires coordination among several organisations. And the more people who know about a vulnerability, the greater the risk of information leaking.
That is exactly what happened in this case. Details identifying the vulnerabilities began circulating just before the scheduled release of the fixes. This forced the PHP project to bring forward its security updates by a day.
The incident demonstrates the unique role AI can play at every stage of such a crisis.
AI helped researchers uncover serious weaknesses in PHP, find ways to exploit them and assist efforts to fix them. These were tasks that would otherwise have required much more time and effort. But AI also made the race to fix the vulnerabilities more urgent, because the same technology could help hackers.
Until recently, some complicated vulnerabilities were difficult to find and exploit simply because doing so required enormous technical expertise and resources. AI could significantly lower these barriers and make attackers much faster. Once information about a weakness becomes public, AI could help hackers develop working attacks within hours, potentially exploiting vulnerable websites before their operators have time to act.
. . .
PHP is not the only software on which a large part of the internet depends. Many others, such as Apache and MySQL, quietly perform essential functions behind the websites and online services we use. Finding their weaknesses before hackers do, fixing them and ensuring the fixes reach everyone who needs them is an enormous task.
One of the biggest challenges becomes apparent when we look at how PHP itself is developed and maintained.
Much of the modern internet relies on open-source software such as PHP. This means developers anywhere in the world can examine the software’s code, suggest improvements and help fix problems. But reviewing these contributions, coordinating official updates and maintaining the software require experienced developers and substantial resources.
Despite PHP’s enormous importance, the nonprofit PHP Foundation, which financially supports some of this work, operates with limited resources. In 2025, it received just $730,534 in donations and had “11 contracted developers who worked part- and full-time to strengthen and improve the core PHP language”.
PHP has a much larger worldwide community of contributors, but that does not guarantee enough experienced developers will be available when a serious security problem arises. The Foundation itself acknowledged that limited resources were one reason the flaw identified in 2024 remained unresolved for so long.
And AI is creating another challenge. According to Elisabeth Barron, the Executive Director of the PHP Foundation, the number of proposed changes to PHP’s code has nearly doubled over the past year, partly because AI has made writing software easier.
So what needs to be done?
The PHP incident itself suggests a way forward to overcome these problems and make the internet safer.
If advanced AI models can help researchers uncover weaknesses in PHP that have escaped scrutiny for more than a decade, they could also be used to examine thousands of other important software projects.
OpenAI has already launched an initiative called Patch the Planet, which brings together advanced AI tools, cybersecurity researchers and open-source developers to identify and fix security weaknesses in important software.
The PHP incident offers an example of this approach in action. Researchers from Calif, OpenAI and Wiz independently identified ways to exploit the vulnerabilities, but subsequently worked with PHP’s developers and other cybersecurity organisations to help prepare fixes and protections. Patch the Planet played a role in coordinating this wider effort.
Similar efforts are underway elsewhere, including Google’s OSS-Fuzz and the Linux Foundation’s Alpha-Omega project, which support security improvements across widely used software.
The challenge now is to extend such efforts to many more software projects, especially those maintained by small teams with limited resources. Finding a weakness is only half the job. Someone must also fix it and ensure that the update reaches the websites that need it.
That would not eliminate cyberattacks or guarantee that defenders would always discover weaknesses before criminals did. But it could substantially improve the security of important software such as PHP, whose maintenance and security teams have long struggled with limited resources.
Subscribe to get updates, bookmark, or comment.