How AI made a crisis that affects 70% of the Internet

Picture Credit: by CNN

Artificial intelligence has exposed critical security vulnerabilities in PHP, a programming language powering around 70% of the world’s websites, raising fresh concerns about the speed at which cybercriminals could exploit weaknesses in digital infrastructure.

Known as PHP2Shell, the vulnerabilities could allow attackers to execute malicious code remotely, access sensitive information stored in memory and potentially compromise websites. Although the underlying flaws had existed for years, exploiting them required complex, time-consuming techniques that were difficult for human researchers to carry out.

Researchers from cybersecurity companies Calif and Wiz, working alongside OpenAI, used AI tools to identify ways to exploit the weaknesses. According to Wiz, AI enabled researchers to complete work that could previously have taken a world-class team months in a fraction of that time.

The discovery has prompted an urgent response from governments and technology companies. The PHP Foundation has released security patches, while the US National Security Agency and European cybersecurity authorities have advised organisations to address the vulnerabilities immediately.

The potential consequences extend across industries, as websites supporting online payments, bookings, subscriptions and other services may rely on affected software. Cloudflare has reported millions of attempted exploits in recent days, highlighting the urgency of the threat.

Several organisations have temporarily taken services offline while applying security measures. Government websites in parts of Europe, services in Japan and systems operated by the Wikimedia Foundation were among those affected by precautionary shutdowns or security upgrades.

Picture Credit: by Choice Tel

Cybersecurity experts say the incident signals a significant shift in digital defence. AI is making it easier to turn theoretical software weaknesses into practical attack methods, reducing the time and resources previously required to exploit them.

However, researchers caution that the vulnerabilities cannot necessarily be exploited with a single command, as successful attacks still depend on specific technical conditions. Even so, outdated systems that remain unpatched could face increased exposure now that details of the flaws are public.

The episode underscores the need for organisations to maintain updated software, strengthen security testing and treat vulnerabilities as urgent business risks. As AI accelerates both cyber defence and offensive capabilities, weaknesses that remained impractical to exploit for years may no longer offer the same protection.