A pair of critical vulnerabilities in PHP, the open-source programming language that powers much of the modern web, has forced governments and companies across the globe into emergency action. 

The vulnerabilities, identified as part of OpenAI’s “Patch the Planet” initiative and flagged separately by Google’s cybersecurity wing Wiz, could potentially give attackers a direct path to a server’s file system or database. 

For an internet ecosystem built largely on top of open-source components, this is a code-red scenario. The vulnerabilities were flagged by AI, and a fix was issued on Wednesday afternoon.

The response has been unusually broad. Finland has shut down state internet services, while the Netherlands’ cybersecurity agency has taken its website offline. France, too, has temporarily taken certain websites down. 

India’s CERT-In (Computer Emergency Response Team) and the US National Security Agency (NSA) have also advised organisations using PHP to update their systems or take their affected systems offline until immediate patching is not possible. Japanese Prime Minister (PM) Sanae Takaichi, in a post on X, urged people to check if their publicly available websites ran on PHP.

The Wikimedia Foundation, which runs the online encyclopedia Wikipedia, said it was addressing the security vulnerabilities. This led to some users experiencing issues accessing the website on Thursday. 

The episode is significant not only because of the severity of the flaws but also because of how they were found. OpenAI said its GPT-5.6 Sol model identified one critical flaw, while Wiz independently discovered and reported both vulnerabilities. 

OpenAI described the episode as “one of the most impactful security issues in recent memory”, arguing that the development demonstrates both the defensive potential of AI and the growing risk that the same capabilities could help attackers develop exploits faster .

Source link