Two major security vulnerabilities have been found in the PHP programming language, which is known to be used by as many as 70 percent of websites worldwide, triggering a cybersecurity alert.

In Europe, some government agencies, hospitals and schools have even shut their websites to avoid being hacked.

News of the discovery of the PHP flaws first surfaced on a public forum, and the organization that manages PHP quickly acknowledged the flaws were real.

The Korea Internet & Security Agency (KISA) and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) recommended updating, while the UK's National Cyber Security Centre (NCSC) and the European Union's CERT-EU also warned of the risk.

According to South Korean security firm Theori, the newly found PHP2Shell is a vulnerability caused by a flaw in the PHP engine itself, regardless of a web application's implementation code. An attacker can remotely execute arbitrary code on a server without separate authentication to take control of the server, or read process memory.

Versions affected by the vulnerability include PHP 8.2.34, 8.3.35, 8.4.26 and 8.5.11 and earlier, as well as all versions of unsupported PHP 8.1 and earlier, including 7.x and 5.x. PHP recommended immediately updating to the latest security patch versions, including 8.2.35, 8.3.36, 8.4.27 and 8.5.12.

AI found the vulnerability, which had been hidden for more than 10 years. It was disclosed through Wiz, a security firm acquired by Google, and an OpenAI-led project.

TechCrunch reported that Wiz discovered the vulnerability using its own security AI agent, Wiz Atlas, along with Google's Gemini 4 Argon and OpenAI's GPT-5.6 Sol. Security testing firm Calif found one PHP flaw through OpenAI's Patch the Planet project, which seeks to find and fix open-source software flaws in advance.

Calif found the vulnerability using OpenAI's AI model GPT-5.6 Sol. The fallout is significant.

The Atlantic reported on Oct. 21 that websites of various European government agencies, hospitals and schools, including Finland's health authorities, the Port of Rotterdam, Paris police and online community 4Chan, blocked access to prevent hacking. The U.S. National Security Agency (NSA) also recommended that companies unable to fix the PHP vulnerability immediately take the service offline.

It could take as long as several weeks for patches to be applied. In the meantime, tens of millions of servers, databases and devices could be exposed to attack, and attempted exploitation, which appears to have been aided by AI, has already been detected, The Atlantic reported.

Sam Rubin (샘 루빈), senior vice president at cybersecurity firm Palo Alto Networks, said, "PHP is one of the foundational technologies supporting the internet."

The internet has been full of bugs for decades, but the balance has held. That is because skilled hackers were rare and it took time to find and exploit vulnerabilities. But AI is breaking that balance, The Atlantic reported.

Software vulnerabilities found each month have doubled over the past year, and some estimates show the time it takes for hackers to use them in real attacks has shrunk from weeks to hours. AI-automated intrusions can sometimes be completed in 39 seconds, The Atlantic reported.

Defenders also use AI, but experts believe AI will widen the asymmetry between attackers and defenders. Hackers can use new technology without hesitation, while companies have to consider risk and can be cautious about adopting it. Hospitals or power grids cannot take the risk that AI security tools could switch off life-support equipment or trigger power outages, The Atlantic reported.

On the same day the PHP flaws were disclosed, the Node.js development team also revealed several high-risk vulnerabilities in Node.js, a JavaScript development framework used by many developers.