AI Finds Serious Security Flaw in Common Website Software

Security researchers have used artificial intelligence to uncover a set of critical security flaws in PHP, a widely used programming language that powers an estimated 70 percent of websites globally. The discovery, named PHP2Shell, has raised concern across the technology industry because of how extensively PHP is used to build and run websites.

The flaws are classified as remote code execution, or RCE, vulnerabilities, a particularly dangerous category of security weakness. RCE vulnerabilities allow an attacker to execute arbitrary commands on a target system from a remote location, potentially giving them significant control over an affected website or server without requiring physical or direct access.

The use of AI to identify these vulnerabilities reflects a growing trend in cybersecurity research, where automated systems are increasingly being deployed to scan complex codebases for weaknesses that might otherwise take human researchers far longer to find. While this approach can accelerate the detection of serious flaws, it also raises questions about the pace at which such tools might be used by malicious actors to find and weaponise similar weaknesses.

Since the vulnerabilities were disclosed, there has been a marked rise in attempted exploitation by hackers seeking to take advantage of unpatched systems before administrators can apply fixes. Exploitation refers to the act of using a vulnerability to carry out an attack. This surge in activity has prompted a number of websites around the world to shut down temporarily as a precautionary measure while operators assess their exposure and apply security updates.

Because PHP underpins such a large share of the internet's infrastructure, the scale of the potential impact is considered substantial. Websites ranging from small personal blogs to larger commercial platforms may rely on PHP in some capacity, meaning that the vulnerabilities could theoretically touch a broad and varied swath of online services.

The incident underscores the dual-edged nature of AI in cybersecurity: the same technology that helps defenders identify and address dangerous flaws before they are exploited can also lower the barrier for attackers to discover comparable weaknesses. As organisations work to apply patches and mitigate risk, the episode is likely to intensify discussion about how AI-driven vulnerability research should be managed and disclosed responsibly going forward.