AI Uncovers 20-Year-Old PHP Flaws Putting Most Websites at Risk

Cybersecurity researchers using artificial intelligence tools have discovered two critical vulnerabilities in PHP that persisted undetected for two decades, prompting emergency shutdowns of government websites across Europe and Canada.

The flaws affect every version of the programming language released since 2004, according to the PHP Foundation, which issued emergency patches Thursday. PHP powers roughly 77% of all websites with a known server-side language, including platforms like WordPress and Drupal.

“All servers using any version of PHP released in the last 20 years will be vulnerable,” said Tiffany Farriss, interim CEO of the Drupal Association. “This issue impacts the majority of the Internet.”

The discovery came from AI-assisted code analysis by cybersecurity firms, though the specific companies and tools were not disclosed in the PHP Foundation’s advisory. The vulnerabilities could allow remote code execution, giving attackers full control over affected servers.

Governments moved quickly. The Netherlands, Denmark, France, and Finland took portions of their official web infrastructure offline as a precaution, Reuters reported. Canada’s Minister of Artificial Intelligence and Digital Innovation, Evan Solomon, announced similar temporary shutdowns on X, urging all PHP operators to patch immediately.

In the United States, the Cybersecurity and Infrastructure Security Agency issued an alert encouraging organizations to apply the updates. The White House said it was briefed on the situation Friday.

The incident highlights a structural problem in open-source security: critical infrastructure maintained by underfunded foundations relies on external researchers — now armed with AI — to find flaws that human reviewers missed for decades.

The PHP Foundation did not respond to requests for comment on whether the vulnerabilities were actively exploited before disclosure.