Wiz researchers have found two critical vulnerabilities in PHP – which originally stood for Personal Home Page – an open-source programming language that they estimate powers 70% of the world’s websites.
If unpatched, the vulnerabilities could lead to unauthenticated remote attacks. The flaw has prompted government agencies and major online services to take systems offline while administrators rushed to install emergency fixes.
“These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history,” Wiz researchers wrote in a blog post.
While the flaws have been around for decades, “demonstrating their exploitability required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve,” they wrote. “Frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit.”
Wiz researchers used their company’s Atlas vulnerability-research agent alongside Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol to find the flaws, and also developed the exploits. The researchers coordinated the disclosure with the PHP team, another security company, and major cloud and infrastructure providers.
The PHP security team said that the flaws affect all PHP installations serving web requests, including systems running WordPress, Drupal, Joomla and Magento. It released patched versions – PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 – and said updating is the only complete remedy.
However, Censys estimates that as many as 1.5 million of 2.6 million internet-connected servers globally were using PHP versions that are no longer supported, meaning administrators must upgrade to supported versions, Reuters reported.
“All servers using any version of PHP released in the last 20 years will be vulnerable,” Tiffany Farriss, interim CEO of the Drupal Association, told the news outlet. “This issue impacts the majority of the internet.”
Government websites in the Netherlands, France, Denmark and Finland were among those taken offline. Wikipedia and the Internet Archive also temporarily disabled systems. In a blog post, Amazon said an attacker attempted to exploit the flaws against one of its decoy systems four days before the public disclosure.