- A critical flaw in PHP, the programming language behind up to 70% of websites, sparked a global cybersecurity scramble.
- Researchers using AI found the vulnerabilities through OpenAI’s Patch the Planet project.
- A leak and a mistakenly posted video forced an early release of the fix, sending hackers racing to exploit it.
- Governments in Europe and Japan pulled websites offline as the National Security Agency urged unpatched systems to go dark.
- Millions of attack attempts have been recorded, but no major breaches have been confirmed yet.
A well-intentioned AI security project designed to fortify the internet has instead triggered one of the most chaotic cybersecurity scrambles in recent memory. Governments from Finland to Japan have yanked websites offline, and the NSA is urging organizations to unplug vulnerable systems that can’t be patched right away — all because of two critical flaws in PHP, the programming language that silently powers as much as 70% of the web.
The mess started when OpenAI’s AI-driven “Patch the Planet” project uncovered the vulnerabilities, but a leak, a mistakenly posted video, and the breakneck speed of AI-assisted hacking turned what should have been an orderly fix into a global emergency.
AI finds hidden flaws, then a leak wrecks the plan
The trouble began when researchers at the security firm Calif, working with OpenAI’s Patch the Planet initiative, discovered two critical PHP vulnerabilities in July. The underlying weaknesses had lurked in the code for 14 years, according to OpenAI President Greg Brockman, but they were so complex that human researchers had dismissed them as impractical to exploit. Wiz researchers said frontier AI models dramatically lowered the bar for an exploit that required “an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve.”
For months, the PHP Foundation quietly coordinated with Calif, OpenAI, Wiz, and Cloudflare to build a patch, planning a carefully staged public release for late October. Then everything fell apart. Basic details of the flaws leaked on social media two days early, and according to the PHP Foundation, Calif researchers “mistakenly published a video” sketching out how the flaws could be abused. The video was deleted, but not before it spread through hacking forums like wildfire. Researchers say criminals then turned to AI to “vibe code” attacks of their own, and the coordinated disclosure became a mad dash to contain the damage.
Governments from Europe to Japan race to unplug
The NSA’s cyber division warned that the vulnerabilities could give hackers “a direct path to the server’s file system or database” and recommended that organizations take systems offline if they couldn’t patch immediately. Governments across Europe moved fast: Finland’s central government shut down public web services, the Dutch parliament and national cyber agency went dark, and Munich’s city administration took sites offline.
In Britain, the Office for Budget Responsibility and several Scottish councils and health boards unplugged their websites. Japan’s Prime Minister Sanae Takaichi issued an “urgent request” for website operators to prepare to patch, even suspending her own official website temporarily.
Millions of attack attempts, but no confirmed breaches yet
Cloudflare CEO Matthew Prince said his network saw thousands of exploit attempts in the 10 hours before the public announcement. Afterward, the count exploded, hitting tens of thousands in under an hour and millions by the time he posted. Amazon spotted hacking attempts as early as October 17 — three days before the leak and four before the official announcement — a sign someone was already probing the flaws.
Yet an attempt is not a breach. Ryan Austin, the Calif researcher who first uncovered the flaws, told the BBC that “it doesn’t look like exploitation has taken off or been widespread.” But the biggest concern remains: Cisco Talos thinks roughly half of the world’s PHP systems may never get an official patch, because many older sites run on unsupported versions of PHP that can’t easily be upgraded.
AI accelerates both discovery and exploitation — and no one is ready
Even OpenAI, whose project found the flaws, acknowledged in a blog post that the incident “highlights how AI can uncover security flaws with internet-scale impact but the same capabilities can also help attackers rapidly develop offensive tools and exploits.”
The White House, meanwhile, took a victory lap, crediting what President Donald Trump has dubbed “super intelligence” with spotting the flaws, even as he pushes back against calls to regulate the AI industry. But the technology Washington is cheering is also arming the hackers. For now, the internet is left holding the bag — patching furiously, and hoping the AI-assisted flood of attacks doesn’t find a crack in the sites that haven’t caught up, or never will.
Sources for this article include:
Please contact us for more information.