Why Two AI-Discovered Critical PHP Vulnerabilities Took Down Half the Internet

PHP, the veteran programming language that powers WordPress and countless websites, is once again in the spotlight due to security vulnerabilities. According to RSS sources, two AI-discovered "critical vulnerabilities" caused serious problems today for 4chan, DeviantArt, Wikipedia, and countless personal blogs. This is not just a minor glitch affecting a few websites—it's a chain reaction rippling through global internet infrastructure.

Scope of Impact: From 4chan to Corner-Blog

The report explicitly states that those affected include not only well-known sites like 4chan, DeviantArt, and Wikipedia, but also "the blog at the corner bar posting dog photos"—meaning any PHP-based website could be vulnerable, especially those running WordPress. As a server-side scripting language, PHP underpins the vast majority of content management systems on the internet, exponentially amplifying the impact of its security flaws.

Specific technical details about the vulnerabilities have not yet been disclosed, but the "critical vulnerabilities" designation suggests attackers could exploit them to execute remote code, steal data, or directly cause service outages. For ordinary users, the most immediate experience is being unable to access websites or encountering functional abnormalities.

Remote Code Execution (RCE) is one of the most dangerous vulnerability types in web security. When an attacker can craft malicious input to make a server execute arbitrary system commands or scripts, RCE is achieved. In PHP contexts, common causes include insecure deserialization (unserialize() handling user-controlled data), file inclusion vulnerabilities (unfiltered include/require paths), and misuse of dangerous functions (such as eval, system, exec). Once RCE is achieved, attackers can steal database credentials, plant backdoors, move laterally into internal networks, or even completely take over the server. For CMS platforms like WordPress with sprawling plugin ecosystems, a single flawed plugin can become an RCE entry point, affecting every site that installs it—precisely the typical path by which this incident spread from well-known platforms to personal blogs.

AI-Discovered Vulnerabilities: A New Variable in Security Offense and Defense

What's noteworthy is that these two vulnerabilities were discovered by AI. This marks a new phase in security research: AI can not only assist with code auditing but also proactively uncover deep flaws that humans might overlook. Although the report doesn't reveal which specific AI tools or methods were used, the fact itself is stunning enough—AI is becoming a significant force in vulnerability discovery.

On the positive side, AI can help developers patch vulnerabilities before they're maliciously exploited; on the negative side, attackers could equally leverage AI to accelerate vulnerability discovery. This double-edged sword effect places the security of widely-used open-source technologies like PHP under even more severe scrutiny.

Fuzzing is a classic automated vulnerability discovery technique: feeding large amounts of random or semi-random malformed data to a target program and monitoring for crashes or anomalous behavior to locate potential flaws. Modern AI-enhanced fuzzing combines machine learning models to generate more targeted inputs, significantly improving coverage and efficiency. Additionally, LLM-assisted code auditing understands code semantics and identifies dangerous patterns (such as unfiltered user input flowing into sensitive functions) to discover logic flaws. These methods can process massive codebases and find issues that human auditors miss due to fatigue or experience blind spots. But AI can also be used by attackers to automate exploit generation or accelerate vulnerability discovery, creating a speed race on both sides of offense and defense—this is the technical backdrop behind the widespread attention on "AI-discovered vulnerabilities" in this incident.

Why Do PHP Vulnerabilities Always Cause Major Waves?

PHP's status as a "goldmine" for attackers is inseparable from its historical baggage and widespread deployment. Many legacy systems still run old PHP versions, and the uneven quality of plugins in ecosystems like WordPress further expands the attack surface. This incident reminds us once again: the internet's underlying dependencies are far more fragile than imagined.

For website administrators, the priority is to monitor patch information released by PHP officials and the security community, and update versions promptly. For developers, it's necessary to strengthen input validation and permission controls at the code level, reducing reliance on dangerous functions.

The WordPress plugin ecosystem is a major amplifier of PHP security risks. WordPress core code undergoes rigorous auditing, but there are over 50,000 plugins worldwide of varying quality—many maintained by individual developers lacking security reviews and timely updates. Plugins typically have the same database and file system permissions as the core, so once a plugin has a vulnerability, attackers can bypass core protections and exploit it directly. More troublesome is that many sites install "zombie plugins" that are no longer maintained—even when official patches are released, no one updates them. This "long tail" distribution makes the impact of a single PHP vulnerability far exceed expectations—from large media outlets to corner blogs, any site running the same vulnerable plugin combination will be affected in bulk at the same time.

What's Next: Patches and Reflection

As of publication, no detailed information about official patches has been released, but it's foreseeable that the PHP community will soon roll out fix versions. This incident also raises a deeper discussion: in an era where AI-assisted vulnerability discovery is increasingly widespread, how can open-source project maintainers keep up with the pace of vulnerability reports? Perhaps AI should not only be the discoverer of vulnerabilities but also part of automated remediation solutions.

Regardless, these three letters (PHP) once again prove their weight in the internet—only this time, in a way that gives website owners headaches.

One-line Summary

Two AI-discovered critical PHP vulnerabilities affected massive sites including 4chan and Wikipedia, highlighting the open-source security crisis.

Paragraph Summary

Two AI-discovered critical PHP vulnerabilities caused serious problems for 4chan, DeviantArt, Wikipedia, and numerous personal blogs, affecting any PHP-based website, especially WordPress sites. The article notes that the vulnerabilities may allow remote code execution, data theft, or service outages, with specific technical details not yet disclosed. The incident highlights AI's double-edged sword effect in vulnerability discovery: it can aid defense but may also be exploited by attackers. PHP is a prime target due to widespread deployment, legacy systems, and uneven plugin ecosystem quality. This incident once again exposes the fragility of the internet's underlying dependencies and prompts reflection on how open-source maintainers can keep pace with AI-driven vulnerability reporting.