Critical PHP Flaws Found by AI Prompt Emergency Patches and Global Site Shutdowns

Overview

• Researchers using advanced AI privately discovered two critical PHP vulnerabilities in August, and a leak of technical details one day before the planned disclosure forced emergency updates released Wednesday.
• The flaws let attackers access server files and databases without a password, creating a direct path to full server takeover.
• The PHP Foundation published emergency patches and the NSA plus national cyber centers urged organizations to apply fixes immediately or take exposed systems offline as a precaution.
• Security firms and Amazon reported probing and attempted attacks against test systems before public disclosure, intensifying the short window defenders have to patch and hunt for intrusions.
• PHP powers roughly 70–75% of public websites, including WordPress and Wikipedia, so smaller agencies and businesses with limited IT resources face the highest risk and should expect further exploit attempts as leaked details circulate.