Attackers attempted to exploit critical PHP vulnerabilities four days before their public disclosure, according to Amazon, which now describes exploitation as widespread. The flaws can give an unauthenticated attacker access to a server’s files or database.
PHP maintainers have released patches. The US National Security Agency urged organizations to update immediately and recommended taking affected systems offline when an update cannot be applied. The UK National Cyber Security Centre issued a similar warning. The risk is unusually broad because PHP underpins WordPress and many other web platforms.
Researchers at Calif and Wiz found the weaknesses with assistance from frontier AI models after the bugs had remained undetected for more than a decade. OpenAI worked with PHP, Calif and Wiz to verify the findings and prepare fixes. Wiz estimated that PHP is used by about 70% of websites, although not every installation is necessarily exposed in the same way.
The incident demonstrates both sides of AI-assisted security research: models helped defenders discover a serious weakness, but attackers can also use the same capabilities to build and adapt exploits. Operators need to rely on verified patches and exposure checks rather than assuming AI discovery gave defenders an automatic lead.