What Is PHP? AI-Discovered Security Flaws Put Millions of Websites at Risk

PHP, one of the most widely used programming languages on the internet, is attracting global attention following the discovery of critical security vulnerabilities through AI-assisted research.

The technology powers the back end of millions of websites, including platforms built with WordPress. Reports that the newly identified flaws could allow attackers to execute code remotely on vulnerable servers have raised serious concerns about the security of the web. But what exactly is PHP, why do these vulnerabilities matter, and how could they affect internet users?

What Is PHP and How Does It Work?

PHP is a programming language primarily used to handle server-side operations on websites. When someone visits a web page, a server can use PHP to process information, retrieve content, and generate the page that eventually appears in the visitor's browser. This allows websites to do much more than display static text and images. They can also deliver dynamic content based on user activity, stored information, and specific requests.

For example, when a news website publishes a new article, a PHP-powered content management system can retrieve the relevant information from a database and display it on the appropriate page. User accounts, login systems, comment sections, search functions, and various online shopping features can also be built with PHP.

One of PHP's defining characteristics is that its code runs on the server rather than directly on the visitor's device. The browser receives the output generated by the server, while the underlying processing takes place behind the scenes. This architecture makes it possible to build interactive websites, but it also means that the security of the server-side software is extremely important.

PHP is free and open source, allowing developers to examine its source code, contribute improvements, and help develop future releases. Maintenance and development efforts are supported by the PHP community and organizations such as the PHP Foundation.

However, open-source software is not automatically immune to security problems. When a technology forms the foundation of millions of websites, a critical flaw can create widespread exposure among systems that have not received the necessary security updates.

Why Does PHP Power Around 70% of Websites?

PHP's importance stems largely from its long-standing popularity in web development. According to W3Techs, PHP is used by approximately 70% of websites for which the server-side programming language is known.

One of the biggest contributors to this widespread adoption is WordPress. The platform powers a broad range of websites, from personal blogs and news publications to business pages and online stores. W3Techs data places WordPress's share of all websites at approximately 40%.

PHP's reach extends well beyond WordPress. Content management systems such as Drupal and Joomla, as well as e-commerce platforms such as Magento, can also rely on PHP. Custom-built websites and various web applications use the language too.

Visitors may not even realize that a website relies on PHP. Because the language generally operates behind the scenes, its presence is not always visible through the website's design or user interface.

This widespread adoption is also what makes PHP security vulnerabilities particularly significant. A flaw may affect far more than one application if multiple systems depend on the same vulnerable technology. Nevertheless, it would be inaccurate to conclude that every PHP-powered website is automatically vulnerable or has been compromised. The actual risk depends on the software version, server configuration, and whether the relevant security fixes have been installed.

What Do the Critical PHP Vulnerabilities Mean?

Security concerns surrounding PHP intensified in October 2026 following reports of two critical vulnerabilities. According to the information in the report, the flaws could allow attackers to execute code remotely on systems that have not received the necessary fixes.

Remote code execution occurs when an attacker can run commands or code of their choosing on a target system over a network. Depending on the vulnerability and the server's configuration, this capability can provide a path to more extensive attacks.

Potential consequences include modifying website content, accessing sensitive files, compromising databases, and gaining control over parts of a server. Credentials, API keys, and other confidential information stored on the affected system could also be exposed, depending on the level of access obtained.

According to the report, CERT-EU assigned the vulnerabilities a score of 9.2 out of 10 under the CVSS 4.0 scoring system. Such a rating indicates a very serious security risk. The report also cites a statement from a technology executive at Cloudflare indicating that initial attacks had been observed, underscoring the need for security teams to respond quickly.

Some public institutions in European countries reportedly took their websites offline temporarily as a precaution. The Wikimedia Foundation, which operates Wikipedia, also reportedly disabled certain systems until security updates could be applied safely.

These measures can be part of a precautionary response to a serious vulnerability. A website being taken offline does not, by itself, prove that it has been attacked or that its data has been stolen.

The central issue is not that every website using PHP is vulnerable. It is that servers running affected software without the necessary security protections may become targets for attackers.

How Did AI Discover Security Flaws That Had Gone Unnoticed for Years?

One of the most notable aspects of this development is the role of artificial intelligence in vulnerability research. Traditional security research often involves examining large codebases, testing potential failure scenarios, and identifying ways in which software might be exploited. These tasks can be particularly time-consuming when dealing with complex systems.

Advanced AI models can accelerate certain stages of code analysis and security investigation. Researchers can use these tools to identify suspicious sections of code, examine potential error conditions, and assess whether a flaw could be exploited in a real-world environment.

The report states that researchers at Calif identified a critical vulnerability during work involving OpenAI's GPT-5.6 Sol model. It also says that Wiz, the cybersecurity company operating under Google, independently identified security issues through research using its own AI tools and models.

According to Wiz, exploiting the vulnerabilities through traditional methods would have required a complicated sequence of steps. AI-assisted analysis can make it easier to investigate code and explore potential attack scenarios.

This development highlights a significant shift in cybersecurity. AI can help developers and security researchers uncover flaws that might otherwise remain undetected for extended periods. However, the same capabilities may also help malicious actors understand vulnerabilities and accelerate their efforts to exploit them.

The disclosure of a vulnerability can introduce another challenge. Once technical details become public, attackers may study the information and attempt to target systems before administrators have completed their updates. The time between disclosure and remediation can therefore be critical. Security teams need to minimize this window of exposure wherever possible.

How Could PHP Vulnerabilities Affect Internet Users?

Because PHP primarily operates on web servers, vulnerabilities of this kind do not initially target the personal computers of ordinary internet users. The main risk lies with servers running affected PHP software without the required security fixes.

However, users can still be affected indirectly if a website is compromised. Attackers might alter its content, use the site to distribute malicious software, or attempt to obtain sensitive information accessible through the affected infrastructure.

Internet users should therefore remain cautious when dealing with suspicious links, keep their browsers and device software up to date, and pay attention to security announcements from services they use.

That does not mean people need to stop browsing the internet or avoid every website built with PHP. Not all sites have the same security exposure. What matters is whether the organizations responsible for those services have applied the appropriate updates and maintained effective security controls.

What Should Website Owners Do?

Anyone operating a PHP-powered website should first determine which PHP version is running on their server. They should then check whether that version is still supported and whether the relevant security fixes identified in official advisories have been applied.

Installing available security updates promptly can help reduce exposure. However, administrators should also verify compatibility with their content management systems, plugins, and other software components before and after updating.

Website owners using older PHP releases should pay particular attention to whether those versions still receive security support. The report specifically highlights PHP 8.1 and earlier versions. However, a version number alone is not enough to determine whether a system is vulnerable. Administrators should consult official PHP security advisories to establish which releases contain the necessary fixes for the specific vulnerabilities.

If a hosting provider manages the website's infrastructure, the owner should contact the provider to confirm whether the relevant updates have been applied. Organizations managing their own servers should also review their backup procedures, access controls, security monitoring, and incident response plans.

Platforms such as Squarespace and Wix should be assessed according to their actual technology stacks. If a particular service does not use the affected PHP components, it may not face the same direct exposure. However, the technologies used by the platform and the components controlled by the customer still matter. A platform's name alone is not sufficient to establish its security status.

What Do These Vulnerabilities Mean for the Future of the Internet?

The PHP security issues highlight how heavily the modern internet depends on shared software components. Relying on common technologies makes website development more efficient, but it can also allow certain security problems to affect a large number of systems at once.

The growing use of AI in software security is likely to make this situation increasingly complex. Developers may be able to identify vulnerabilities earlier and improve their software more quickly. At the same time, attackers may use similar tools to locate weaknesses and investigate vulnerable systems more efficiently.

As a result, cybersecurity will depend on more than building secure software. Regular updates, replacing technologies that have reached the end of their support periods, reporting vulnerabilities promptly, and sharing security information across organizations will become increasingly important.

PHP remains one of the foundational technologies of the web. Recent developments serve as a reminder that widespread adoption does not automatically make a technology unsafe. The more important question is whether the software is maintained, updated, and managed securely.

As AI-assisted research makes it possible to uncover certain vulnerabilities more efficiently, developers, hosting providers, and website owners will need to respond quickly. In an environment where both security researchers and malicious actors can benefit from increasingly capable AI tools, timely patching and effective security practices are more important than ever.