AI-assisted research exposed major PHP security flaws that pushed governments in Europe and the U.S. to take websites offline Wednesday while the FBI warned of remote code execution risks.
Governments and other organizations scrambled to patch systems after researchers, working with artificial intelligence tools, uncovered serious vulnerabilities in PHP, the programming language that runs a huge share of the web. AP News reported that sites across Europe and the United States went dark temporarily as operators raced to install security updates.
The FBI’s cyber division warned that the flaws could let malicious actors remotely execute code in PHP and put sensitive data and networks at risk. Officials recommended that operators take websites offline if they could not update them right away.
Finland offered a clear public example. Finnish government websites were only partly available Wednesday. Visitors saw a message that government sites were experiencing a temporary disruption and were fully or partially unavailable while the issue was being resolved.
The PHP Foundation said Wednesday it had released fixes for the vulnerabilities, along with instructions on how to update systems. OpenAI, the San Francisco-based company, said PHP’s maintainers led those fixes and the release.
In a blog post, OpenAI said it had led a coalition of researchers, security providers, and others to address the PHP problems over the past two months. Partners named in that effort included Wiz and Cloudflare, which contributed research, technical support, and coordination to prepare protections ahead of disclosure.
OpenAI put the stakes in blunt terms.
OpenAI stated:
"PHP’s maintainers led the fixes and release, with our teams and partners like Wiz, Cloudflare, and others contributing research, technical support, and coordination to prepare protections ahead of disclosure,"
The company called the flaws “one of the most impactful security issues in recent memory.” It also said AI appeared to find the vulnerabilities before any attackers did.
OpenAI went further on what comes next:
"As significant as they are, these bugs are among several significant vulnerabilities we’ve already found and are working to fix, and we expect similar findings to increase sharply in the coming months,"
Ismael Valenzuela, vice president of labs, threat research and intelligence at cybersecurity firm Arctic Wolf, said PHP powers roughly 70% of websites where the server-side programming language is known. He warned that the potential impact is enormous and that the flaws put a significant portion of the internet’s business and commercial infrastructure at potential risk.
Valenzuela noted that the problems do not mean every website is vulnerable, but he said they demand immediate attention. Some of the weaknesses, he said, have existed for more than a decade.
Valenzuela told reporters:
"What changed wasn’t the underlying code, but the ability to find those weaknesses and turn them into working exploits,"
That is the core shift. Long-standing bugs sat in widely used software. AI-assisted research made them easier to find and easier to turn into working attacks. Defenders got there first this time, according to OpenAI. The window between discovery and abuse is shrinking either way.
Raghu Nandakumara, vice president of industry strategy at cybersecurity company Illumio, framed the same tension from the operator’s side. Organizations want AI fast enough to catch what humans miss. They also need autonomous systems kept inside boundaries people understand and control.
Nandakumara said:
"There’s an important paradox here. We want AI to move quickly enough to find vulnerabilities humans might miss, while also making sure that increasingly autonomous systems operate within boundaries we understand and control,"
He added that the faster AI becomes at finding weaknesses, the more important it becomes to plan for what happens after those weaknesses are exposed, especially when organizations cannot patch every affected system at once.
His closing point was plain:
"The lesson isn’t that AI is inherently dangerous or inherently protective. It’s that speed without control creates a new kind of security problem."
The Wednesday outages were not abstract. When government sites in Europe and the U.S. go offline, citizens lose access to services while agencies rush updates. The FBI’s guidance was direct: if you cannot patch immediately, take the site down rather than leave a remote-code hole open.
That advice is a measure of how deep PHP sits in the public-facing internet. A language tied to roughly seven in ten sites with a known server-side stack is not a niche risk. It is infrastructure. When flaws in that layer surface, some of them more than a decade old, the cleanup is measured in hours of downtime and hurried change windows, not tidy maintenance notes.
OpenAI’s coalition model, maintainers in the lead, private research and edge providers in support, bought time before disclosure. The company says AI found these issues ahead of attackers. It also says more findings of this kind are coming, and soon. That is a warning to every agency and firm still running unpatched PHP, not a victory lap.
Critical public websites should not depend on decade-old holes staying hidden. When AI shortens the search, patch discipline and honest offline decisions become the difference between a controlled outage and a preventable breach.
