A PHP vulnerability affects 70% of the Internet.. What do we know after a temporary shutdown of global websites?

The websites of many government and companies around the world were down for a short period, on Wednesday, after artificial intelligence contributed to discovering and addressing serious security vulnerabilities that may affect 70% of the Internet. These vulnerabilities were discovered by teams at OpenAI, Google's Wiz, and Calif, a cybersecurity company.

Collectively known as PHP2Shell, these vulnerabilities are capable of enabling attackers to execute code and read memory that may contain sensitive information, such as passwords. The companies explained that artificial intelligence played a crucial role in discovering these vulnerabilities on Wednesday, as it enabled researchers to conduct security research on multiple applications in just hours.

This revelation comes after developments in the field of artificial intelligence raised concerns from Washington to Silicon Valley about how this technology could be exploited to enhance cyber attacks. “Thanks to cutting-edge AI models and the right tools, one researcher accomplished in one week what would previously have taken months of work by a world-class team,” Wiz researchers wrote in a blog post on Wednesday.

Wiz researchers used Gemini 4 Argon data models from Google, Wiz Atlas, and GPT-5.6 Sol from OpenAI during the research process. The vulnerabilities were discovered in late August, but were disclosed to the public on Wednesday after PHP released an update to fix them.

The PHP Foundation, the body responsible for the PHP programming language at the center of this vulnerability, has issued an update to fix the vulnerabilities and is urging website operators to update their systems immediately. WIS researchers say this issue is comparable to the 2014 Heartbleed vulnerability, which affected an encryption technique estimated to be used on two-thirds of websites. Heartbleed allowed cybercriminals to access data that was supposed to be protected.

As with HeartBlade, Waze researchers believe that PHP2Shell could be a turning point in cybersecurity. While the vulnerabilities have been around for years, artificial intelligence has made exploiting them practical.

“The latent flaws have been around for decades, but proving that they can be exploited required an extremely complex series of steps, on the edge of what human researchers can feasibly achieve,” WES researchers wrote in a blog post. “Sophisticated AI models have dramatically reduced this barrier, turning an ancient flaw into an exploitable vulnerability.”

According to web infrastructure provider Cloudflare, which is working with the PHP Foundation, Calif, OpenAI, and Wiz to address this issue, these vulnerabilities could allow attackers to remotely execute code, disrupt services, and expose customer data. In a post on social media, the US National Security Agency urged organizations using PHP to update their systems, or take them down if they were unable to do so.

The revelation has prompted some government websites in Europe to temporarily shut down their operations while companies update their systems, according to Reuters.