A long-overlooked security weakness in PHP, a programming language used to power a large share of the world’s websites, has raised fresh concerns about the growing ability of artificial intelligence to uncover and exploit cyber vulnerabilities.

The flaw had been a concern among cybersecurity researchers for more than two decades. In July 2004, security researcher Stefan Esser warned that a serious weakness in PHP could potentially allow attackers to steal passwords and databases or take control of entire websites.

Despite subsequent discoveries of similar vulnerabilities and partial fixes, the underlying risks persisted. What changed was the time required to turn those weaknesses into practical attack methods: tasks that once demanded extensive, painstaking coding could now be accelerated dramatically by AI.

The issue gained renewed attention on Wednesday, when OpenAI publicly disclosed methods for exploiting the vulnerability and announced a security update intended to address it. The disclosure has raised concerns among researchers that AI tools could help malicious hackers discover and exploit weaknesses that have remained difficult to use for years.

A Long-Standing Weakness in the Internet’s Foundations

The episode has highlighted how much of the internet relies on ageing software, legacy protocols and layers of security patches that were developed over decades.

Websites, applications, banking services, cloud platforms and communications systems depend on interconnected technologies. A vulnerability in one widely used component can therefore create risks far beyond a single application.

On July 30, researchers at AI security company Calypt began testing PHP as part of OpenAI’s “Patch the Planet” initiative. They assigned a large language model the task of finding security weaknesses, initially expecting limited results.

By August 1, the researchers had discovered a method for exploiting PHP vulnerabilities. They found additional techniques in the following days. Later that month, Wiz, a cybersecurity company backed by Google and also involved in the initiative, identified another exploitation method.

The findings were made public on Wednesday alongside the release of a security patch. Wiz described the vulnerability as one of the most serious in software history.

Vyas Sekar, a professor of electrical and computer engineering at Carnegie Mellon University, said AI can perform such tasks far faster than humans. He warned that PHP is unlikely to be an isolated case, noting that many other vulnerabilities could potentially be identified and exploited using similar techniques.

AI Lowers the Barrier to Cyberattacks

The central concern is not simply that the vulnerability existed, but that AI has made the work needed to exploit it significantly easier.

Ryan Austin, a researcher at Calypt, wrote in a blog post that the team did not use a specialised model to find the PHP weaknesses. Instead, they used a model accessible to ordinary users.

The development has intensified concerns about the dual-use nature of AI: the same technology that helps security teams discover weaknesses and repair software can also help attackers identify ways into vulnerable systems.

Anthropic’s decision not to release its advanced cybersecurity-focused model, Mythos, publicly in June was cited in the report as another example of growing caution over AI systems capable of identifying software vulnerabilities.

Nick Rogers, chief executive of Fieldwork AI, said finding a suspected weakness can involve repetitive and exhausting work. AI systems, however, can continue testing possibilities until they find a viable approach, potentially completing tasks that would otherwise require substantial human effort.

How the PHP Vulnerability Worked

PHP is widely used to build and operate websites. According to the report, the vulnerability involved information remaining in server memory after a process crashed because it ran out of memory.

Under certain conditions, attackers could potentially use that leftover information to expose data or execute malicious code. Exploiting the flaw was difficult because attackers had to trigger a server memory failure at a precise moment while bypassing PHP’s security protections.

Researchers using AI found several ways to overcome those barriers.

One method involved inconsistencies in how PHP handled compressed and decompressed files. The discrepancy could allow a compressed file to enter a server and subsequently be unpacked in a way that created an opportunity for an attacker to gain control of the system.

Another technique involved constructing highly complex file structures that placed excessive pressure on PHP’s directory-handling mechanisms, triggering memory-related errors.

These findings demonstrated how AI could help researchers turn an obscure technical weakness into a more practical exploitation method.

Security Patches May Not Be Enough

Although a security patch has been released, researchers remain concerned about the continued use of outdated PHP versions.

Adam Meyers, vice-president at cybersecurity company CrowdStrike, warned that many older versions of PHP remain in operation. As a result, the new patch may not eliminate every related risk across the internet.

OpenAI’s recommendations accompanying the patch emphasised the need to write safer code from the outset. However, applying that principle to existing applications is not straightforward.

Meyers said migrating applications from PHP to another technology could be expensive because it may require rebuilding entire applications rather than simply switching service providers.

With PHP reportedly used by around 70% of websites, replacing the technology across the internet would be an enormous undertaking.

What Comes Next?

The episode underscores the need for a fundamental shift in how software security is approached as AI becomes more capable of identifying vulnerabilities.

Security teams may need to assume that weaknesses once considered too difficult or costly to exploit can become practical attack routes much more quickly. Regular security updates, timely patching, careful monitoring and the maintenance of supported software versions will therefore remain essential.

The larger challenge is that AI can accelerate both sides of cybersecurity. It can help defenders identify and repair vulnerabilities, but it can also lower the technical barriers facing attackers.

A weakness that remained difficult to exploit for 22 years may now be easier to weaponise in days. That shift could force organisations around the world to rethink how quickly they identify, prioritise and fix vulnerabilities in the software underpinning the modern internet.