AI System Discovers PHP Vulnerability Affecting 70% of World's Websites

An AI-driven security research system independently discovered a previously unknown vulnerability in PHP, the programming language that underpins a large share of the world's websites, with researchers describing it as one of the most severe web vulnerabilities found in a decade.

Key points:

• PHP is the foundation for a huge share of existing websites, including large portions of major content-management systems, meaning a flaw at this level has unusually broad reach.

• The vulnerability was reported through responsible-disclosure channels before public details were released, giving site operators and PHP maintainers time to patch before attackers could widely exploit it.

This is one of the clearest examples yet of AI being used productively for defense—finding a serious flaw before attackers did—which cuts against the week's other security stories where AI was the attacker's tool rather than the defender's.

The discovery demonstrates that AI is now a major actor on both sides of the cybersecurity fight simultaneously. Organizations that haven't audited their own exposure are already behind.

Website operators and IT teams should confirm their PHP installations are updated to the patched version referenced in official PHP security advisories this week.

Why It Matters: This discovery shows AI can find critical vulnerabilities faster than human researchers—a capability that's valuable for defense but equally concerning if the same techniques are used by attackers.