The homepage of the PHP.net website is seen on October 22, 2026 in Singapore. Cyber-security flaws were recently identified in the popular PHP programming language, which is used on a vast number of websites across the world, including those of major companies and national governments. The PHP Foundation released two patches designed to fix the vulnerabilities. Yong Teck Lim/Getty Images hide caption
A few months ago AI caused global alarm after autonomous agents were found to have cheated on evaluations and then tried to cover it up, in what became known as the "Hugging Face hack."
This week, AI and hacking are back in the spotlight with AI technology credited to have helped prevent a global cybersecurity crisis.
Cyber-security firm Wiz Research, using OpenAI technology, announced on Wednesday it had discovered security flaws in a computer programming language that helps run some 70 percent of the world's websites.
OpenAI called the bug "one of the most impactful vulnerabilities in recent memory." Wiz Research warned that its "successful exploitation could allow attackers to take control of affected servers, steal sensitive data, and deface the websites running on them."
Corporations and governments from the U.K. to Japan are now rushing to prevent hackers from capitalizing on the flaws.
The flaws were discovered in a major programming language called PHP, short for Hypertext Preprocessor. Wiz Research calls PHP "the backbone of the web," saying the technology has underpinned much of the internet since the 1990s.
"These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history," the firm said, adding that before publicly disclosing the flaw, teams had worked on building a solution that's now available to websites to protect themselves.
As countries scrambled to prevent cyberattacks, numerous websites and pages were taken offline in the past few days. The U.S. National Security Agency warned organizations using PHP to "maintain heightened awareness" over the coming weeks. The U.K.'s National Cyber Security Center called on organizations to "take immediate action" to update their websites to the latest fixed or patched version.
Dozens of British and Finnish government services were taken offline this week. In France many local government sites were also briefly taken down. China's Industry Ministry urged entities to review security gaps.
In Japan, Prime Minister Sanae Takaichi put out "an urgent request for everyone to take action," adding "If it is difficult to apply the fix patch promptly, temporarily suspending websites and similar measures can be considered an effective way to reduce risk."
Matthew Prince, the head of the cybersecurity firm CloudFlare, said his organization saw tens of thousands of attempts to exploit the flaw in the first 45 minutes of its discovery. That's now in the millions, Prince said on Thursday.
Wiz Research said the flaws in PHP had been present for decades.
"But demonstrating their exploitability required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve," the organization said. The AI models have "substantially reduced that barrier, turning a longstanding flaw into an exploit. "
NPR does not offer or accept money for coverage or interviews. Anyone who makes such an offer or request is not an NPR employee and does not represent NPR.
