Two critical security flaws, affecting almost all versions of the PHP programming language, have unleashed an unprecedented global alert in the digital infrastructure of the Internet. The bug, identified in the core engine of the language and kept in the shadows for more than ten years, was discovered and analyzed with the help of advanced artificial intelligence models.

The severity of the flaw, a set of vulnerabilities in one of the most popular programming languages, which powers up to 70% of the world's websites and web applications, triggered intense global activity to apply emergency patches to vulnerable structures.

The maintainers of PHP — used to create and run web applications and the vast majority of websites — issued an urgent notice alerting about the flaws. Hundreds of websites were down on Wednesday as administrators responded to the warning. It prompted the preventive and temporary blocking of government web portals in various European countries, including France, the Netherlands, Finland, and Denmark.

The flaw allows remote code execution (RCE) without the need for authentication, as well as data exfiltration directly from the server's memory. The vulnerability resides in the handling of fatal errors in the PHP engine and directly affects platforms like WordPress, Drupal, and Joomla. "The underlying flaws originate in the handling of fatal errors and memory security issues within the core PHP engine," international cybersecurity agencies noted, warning about the imminent risk of total control of affected servers.

The detection and analysis of this issue represent a milestone in the technology industry. The firm Wiz Research used artificial intelligence systems, such as Google DeepMind's Gemini 4 Argon and OpenAI's GPT-5.6 Sol, to reconstruct the memory behavior and exploitation chain in a matter of days. The use of these agents advanced a reverse engineering task that would have taken human researchers months to complete, demonstrating the decisive role of AI in modern defensive cybersecurity.

Why It Matters

The impact of this vulnerability is monumental, due to PHP's dominant position in contemporary web architecture. Industry estimates indicate that nearly 70% of all active websites in the world operate on this language. Since the flaw is located directly in the execution core and not in the final application code, not even pages with the best programming practices were safe if they ran a vulnerable version of the interpreter.

Many servers in the region lack automated update schemes or real-time patches. An attack vector of this nature directly exposed confidential databases, transactional data, administrative credentials, and encryption keys in thousands of Latin American organizations.

The event also marks a strategic turning point in the realm of global computer security. The ability of next-generation language models to audit source code, model corrupt memory states, and accelerate vulnerability discovery shows that AI has become an indispensable tool. However, agencies warn that this same technical potential could be exploited by malicious actors to accelerate the creation of exploits on a large scale against legacy systems in the near future.

What's Next

In the face of imminent risk, the PHP development team reacted by releasing urgent security patches to fix the errors in the core engine and neutralize known variants. Simultaneously, major infrastructure and cloud infrastructure providers — including Cloudflare, Amazon Web Services, Google Cloud, and Microsoft — deployed immediate protection rules in their web application firewalls (WAF) to filter and block attack patterns targeting this vulnerability.

Global cybersecurity agencies, led by the UK's NCSC and the US's CISA, urged organizations to conduct an urgent inventory of their systems. Official recommendations dictate applying security patches as a priority in all production environments. For those organizations that cannot update their systems immediately, it is advised to implement the temporary configuration mitigations indicated by the PHP team or, in the worst case, to preventively disconnect vulnerable servers from the public network.

In the coming months, companies' IT operations teams will need to conduct deep forensic audits to rule out the presence of backdoors (backdoors) installed before the patches were applied. It is expected that international regulatory bodies will begin to require AI-assisted code analysis as a standard requirement within cybersecurity compliance frameworks for open-source software.

Context

The PHP language, originally created in 1994 by Rasmus Lerdorf, has been the backbone of dynamic web development for three decades. Its accessibility and ease of deployment allowed for the massive expansion of the Internet in the early 2000s, driving the creation of the most widely used content managers on the planet. However, given its vast history and the presence of legacy code blocks in its underlying C engine, memory management has always been one of its greatest maintenance challenges.

For more than ten years, the flaw remained undetected due to the extreme complexity involved in chaining fatal memory errors and corruption in deserialization without causing the immediate collapse of the process. It was not until the coordinated collaboration between security researchers, the PHP core development team and tech giants equipped with artificial intelligence platforms, that the complete threat scenario was successfully simulated before its massive public disclosure.

Read more: The Record, CNBC, Wiz