Governments around the world are rushing to put safety measures in place after AI technology found "severe" vulnerabilities in PHP, a key programming language. Reporting on the story says hacking attempts have risen since the flaws came to light. The PHP vulnerabilities AI discovered affect software that runs roughly 70% of websites, which is why this story matters well beyond developers and system administrators.

You do not need to understand PHP to be affected by it. The sites you log into, shop on, or read every day may be built on it. Here is what we know, what it means, and what you can do.

Why PHP Flaws Reach So Many Websites

PHP is a server-side programming language. When you load a page, PHP often runs behind the scenes on the website's server to build what you see, check your login, or pull your details from a database. Because it is so widely used, a flaw in PHP itself is not limited to one website. It can potentially touch a huge share of the web at once.

That is the core of the concern. Coverage of the discovery describes the bugs, nicknamed "PHP2Shell" in some reports, as capable of letting attackers execute code and read memory on affected servers. Reports also say the underlying flaw had existed for more than a decade, which means it sat unnoticed in widely deployed software for years.

A language-level bug also differs from a typical website hack. Fixing it is not up to one company. Every site owner, hosting provider, and organization running PHP has to apply the update on its own schedule, and some will be slower than others.

How AI Is Speeding Up Vulnerability Discovery

What makes this story stand out is how the flaws were found. According to reports, researchers at a firm called Calif used an OpenAI model to identify the problems and found the bugs in a matter of days. Security teams have long combed through code for weaknesses, but that work has traditionally been slow and labor-intensive.

The discovery shows how quickly AI can help locate flaws in code that humans reviewed for years without catching them. That is encouraging for defenders, since the same speed can help fix problems before criminals find them. But it also narrows the window between a flaw being disclosed and attackers trying to exploit it. If researchers can find bugs this fast, it is reasonable to expect others, including bad actors, to use similar tools.

That tension is why governments are moving quickly. The goal is to get patches applied before the gap between disclosure and fix is exploited at scale.

What Attackers Are Doing Right Now

The headline fact is that hacking attempts have risen since the flaws were disclosed. This follows a familiar pattern: once a vulnerability becomes public, attackers scan the internet for sites that have not yet been updated and probe them for weaknesses. Sites that have not patched are the easiest targets.

Reports also indicate that the official PHP website and several other organizations were among those exposed to the vulnerabilities, a reminder that even well-resourced, security-aware groups can be caught up in an issue like this.

It is worth keeping this in proportion. A rise in attempts does not mean every PHP site has been compromised. Many site operators will patch promptly, and many attacks will fail. But the risk is real for sites that lag behind, and you usually cannot tell from the outside which sites those are. For broader context on how this fits into the wider threat picture, see our ThreatsDay roundup, which covers more than 30 separate security stories in one briefing.

What This Means For You

You cannot patch a website's server yourself, and that is the uncomfortable part. When a flaw like this exists, the safety of your data depends partly on how quickly the sites you use respond. If a site you rely on is compromised, details such as your email address, password, or other account information could be at risk.

What you can control is how much damage a single compromised site can do to the rest of your digital life. The steps below limit that damage regardless of which site is affected.

What Everyday Users Can Do to Protect Their Accounts

  • Use a unique password for every account. If one site is breached, a unique password stops attackers from trying the same login elsewhere. A password manager makes this practical.
  • Turn on two-factor authentication (2FA). Even if a password is stolen, a second verification step makes it much harder for someone to get in. Where possible, prefer an authenticator app over text messages.
  • Stay alert to phishing. Incidents like this often trigger follow-up scam emails claiming your account was affected. Do not click links in unexpected messages. Go to the site directly instead.
  • Watch for breach notices. If a service you use tells you it was affected, change your password promptly and review your account activity.
  • Keep your own software updated. Browsers, apps, and devices get security fixes too, and updates close doors attackers rely on.

The Bottom Line

The PHP vulnerabilities AI discovered are a clear example of how fast the security race is moving. The same technology that helped uncover long-hidden flaws can also shorten the time attackers have to act, which is why governments and site operators are rushing to respond. You cannot fix PHP, but you can make your accounts far harder to exploit. Start with unique passwords, switch on two-factor authentication, and treat unexpected account emails with suspicion. For more on the threats shaping this moment, read our ThreatsDay roundup and keep your defenses current.