Safety · 2026-10-22

AI found holes in PHP that hackers have already started using: what website owners should do

Vulnerabilities in PHP, the language behind much of the world's websites, were found with AI, and hackers began exploiting them before they were publicly announced.

✨ What happened

Amazon said that hackers are broadly exploiting vulnerabilities in the PHP programming language. According to Amazon, attackers tried to use one of the bugs four days before it was made public.

The bugs were found by researchers at the US cybersecurity firms Calif and Wiz with the help of models from OpenAI and Google. Wiz estimates that PHP powers about 70 percent of websites worldwide. The bugs had gone undetected for more than a decade.

Why it matters for ordinary people

PHP is the language many websites are built on, including those running WordPress. That means the vulnerability can affect blogs, online shops and company sites, even if you have never heard of PHP.

The US National Security Agency (NSA) urged all organizations using PHP to update their systems immediately or take them offline temporarily. The UK's National Cyber Security Centre said a hacker could take control of a website's server without a password or login. Some governments in Europe reportedly took sites offline while the flaws were patched.

📌 What to do

If you run your own website or blog, check whether your hosting provider and your site software (for example, WordPress) have installed the PHP updates, and install them. If no update is available yet, consider taking the site offline temporarily, as the NSA recommends, or contact your hosting provider.

PHP developers released patches on the same day the warning was issued, so updating is the most important step. OpenAI also said that AI can help find such bugs, but the same capabilities can help attackers quickly build malicious tools.

Sources: 🔗 Ars Technica — AI