OpenAI has helped uncover critical PHP vulnerabilities that could expose millions of websites to cyberattacks, prompting emergency security updates and an international response. Researchers from OpenAI, Wiz, and Calif used advanced artificial intelligence tools to identify flaws that could let attackers execute malicious code and access sensitive information. The vulnerabilities, collectively known as PHP2Shell, affect software that powers roughly 70% of websites worldwide.
PHP Developers Release Emergency Security Updates
The PHP Foundation released emergency patches on October 21, covering versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Consequently, administrators must update vulnerable installations immediately or consider taking affected systems offline.
Additionally, the flaws affect PHP’s core engine, potentially exposing websites running popular platforms such as WordPress and Drupal. Cloudflare deployed firewall protections before public disclosure and observed exploitation attempts.
Wiz researchers also compared the vulnerabilities’ potential significance to Heartbleed, a major security flaw discovered in 2014. However, unsupported PHP versions will not receive official fixes, leaving some systems particularly vulnerable.
AI Accelerates Cybersecurity Research
OpenAI’s Patch the Planet initiative coordinated researchers, software maintainers, and infrastructure providers to prepare fixes before disclosure. Besides identifying weaknesses, AI tools helped researchers demonstrate exploitability and coordinate defenses more quickly.
Moreover, OpenAI pledged $1 billion in subsidized access to Daybreak cybersecurity tools through its Frontline Defenders initiative. Significantly, the discoveries highlight AI’s growing dual role in cybersecurity, strengthening defenses while potentially helping attackers develop sophisticated exploits.
Related: Kalshi Taps Bitcoin-Backed Loans to Expand Leveraged Crypto Futures Trading
Disclaimer: The information presented in this article is for informational and educational purposes only. The article does not constitute financial advice or advice of any kind. Coin Edition is not responsible for any losses incurred as a result of the utilization of content, products, or services mentioned. Readers are advised to exercise caution before taking any action related to the company.
