The internet had a bad day on Tuesday. Wikipedia went dark. DeviantArt threw errors. 4chan stopped working. Government sites in the Netherlands and Finland shut down as a precaution. The culprit wasn’t a novel zero-day exploit or sophisticated nation-state attack. It was two bugs in PHP, the 30-year-old programming language that powers huge chunks of the web, including every WordPress site ever made.

Here’s the twist: AI found them.

OpenAI and Google’s Wiz both discovered critical vulnerabilities in PHP’s core code using automated security tools. The bugs, now tracked as CVE-2026-TBD, allow attackers to execute arbitrary code on vulnerable servers. That’s about as bad as it gets in security terms. The NSA’s cybersecurity division issued a rare public warning urging organizations to patch immediately.

The PHP Foundation confirmed both vulnerabilities are “critical” and pushed emergency patches. But the damage was already done. Millions of sites had to scramble to update, and many took the cautious route of going offline until they could verify they weren’t vulnerable.

The Double Edge

This is exactly the scenario security experts have been warning about. AI can scan codebases at scale, identifying vulnerabilities that human reviewers might miss for years. That’s good when the researchers work for OpenAI or Google. It’s catastrophic when the same capabilities are available to attackers.

“This is the kind of security issue that was found and prevented by AI, but is also a high risk because of AI,” a TechCrunch report noted. The technical details of the vulnerabilities haven’t been fully disclosed yet, but both involve memory corruption issues in PHP’s request handling. These are old-school bug classes, the kind that have plagued C-based code for decades. PHP is written in C.

What makes this incident notable isn’t that the bugs existed. Every sufficiently complex codebase has bugs. It’s that AI found them first, and now everyone knows AI can find them.

The Race No One Wanted

The security community now faces an uncomfortable reality. The same AI tools that helped OpenAI and Wiz discover these flaws are rapidly becoming commoditized. GPT-4 and similar models can already assist with basic vulnerability research. As these capabilities improve and spread, the window between discovery and exploitation shrinks.

Traditional responsible disclosure assumes researchers have an advantage. They find a bug, notify the vendor privately, wait for a patch, then publish details after users have time to update. That model breaks down when both sides have the same tools.

The PHP vulnerabilities highlight another problem: critical infrastructure running on volunteer-maintained code. PHP isn’t backed by a major corporation with dedicated security teams. It’s maintained by the PHP Foundation, a nonprofit supported by donations and volunteer developers. When a bug this serious appears, the foundation has to coordinate a response across thousands of hosting providers, millions of websites, and dozens of Linux distributions that package PHP.

They did it, but barely. The fact that major sites went down despite having professional security teams shows how hard this problem is to solve at scale.

What Happens Next

The PHP Foundation is still analyzing how the vulnerabilities went undetected for so long. Preliminary reports suggest the affected code has been in production for years, possibly decades. That raises questions about what else might be lurking in other widely used open-source projects.

Several governments are already responding. The Dutch and Finnish agencies that took sites offline haven’t brought them all back yet. They’re conducting full security audits before restoring service. The NSA’s public warning suggests US agencies are doing the same, though they haven’t said so explicitly.

For the rest of us, the lesson is simpler: update your PHP installations. The patches are out. The exploits will follow soon if they haven’t already. AI found these bugs, and AI will help attackers exploit them. The only advantage defenders have now is time, and that window is closing fast.

The PHP Foundation has published security advisories at php.net. If you run a WordPress site or anything else on PHP, check your version and update immediately. This isn’t a drill.