AI Found an Internet Flaw Hidden for Years, and Gave Hackers Minutes to Use It

For years, a flaw sat buried deep in the code that runs much of the internet, and no one saw it. Then artificial intelligence found it, and suddenly everyone had minutes to act.

The code at issue is PHP, a common building block for websites that most visitors never notice. Many readers may not recognize its name, but they encounter it every day when they open government forms, news sites, and online stores.

On Wednesday, officials pulled official sites offline in France, Finland, the Netherlands, and parts of Asia after learning of a serious defect in PHP. Programmers hurried to issue urgent repairs for problems that had apparently lurked unnoticed for years, spotted with help from AI systems built by Google and OpenAI.

That discovery shows how AI has changed security on both sides. The same kind of tool that can patiently scan millions of lines of old code and spot a weakness humans missed can also help an attacker quickly build a way in once a fix is public.

That is why speed now matters so much. Rafael Sata, a cybersecurity reporter, put it this way: "It could take days, weeks, maybe even months before attackers tried to figure out how to take advantage of a weakness that had been patched. Now, AI tools enable attackers to do that in a matter of minutes."

Defenders need a head start, which is why early disclosure of the flaw caused such concern. Many government and other websites were simply yanked offline because officials feared hackers would strike before patches could be applied.

Big organizations, governments, and major companies are likely to take aggressive steps in moments like this, either taking systems offline or making sure they are properly patched. Sata warns the bigger worry is the long tail of personal websites, small storefronts, and small businesses on shared servers, saying, "They may not even know who updates their PHP instance," and that those owners may not realize their sites are vulnerable.