AI models uncover major PHP flaws that threaten 70% of global websites
Exposes critical flaws in PHP code powering 70% of global websites using AI tools. Prompts FBI offline warnings as Japan takes bank pages down preemptively.
Researchers at Calif and Wiz used artificial intelligence tools to discover critical remote code execution vulnerabilities in PHP software, according to reports from WIRED, NPR, and The Hacker Wire. The affected software powers approximately 70% of the world's websites.
The security teams utilized OpenAI's GPT-5.6 Sol and Google's Gemini 4 Argon models to identify the security flaws. Software fixes were officially released on October 21 to patch the legacy code issues.
The Federal Bureau of Investigation urged unpatched websites to temporarily go offline following the discovery. Government ministries and several banks in Japan preemptively took down selected web pages to manage risks.
The PHP Foundation reported no confirmed breaches as of October 25. Meanwhile, an open-source plugin called Cognition Devin is automating pull requests for affected repositories to accelerate fixes.
The Chief Executive Officer of Cloudflare warned that AI-discovered vulnerabilities will cause continuous operational disruptions across digital infrastructure. Venture capital partners at Andreessen Horowitz categorized the surge in legacy vulnerabilities exposed by AI tools as part of Black October.
What do these terms mean?
remote code execution: A security vulnerability that allows an attacker to execute arbitrary commands or code on a target server remotely.
pull requests: Proposed code changes submitted to a software repository that allow developers to review and merge updates into the main codebase.
Weekly Newsletter
Read between the lines before everyone else. Decode the most important economic, tech, and decision-maker movements in the region.. in 5 minutes every Saturday.
