Equities

Governments urged websites to go dark over two critical PHP flaws, and security firms saw no successful attacks by Thursday evening

Wiz says frontier AI helped turn longstanding PHP bugs into an exploit. Nine security firms told NBC News they had seen no successful attacks as of Thursday evening.

By Marcus Rodriguez · Oct 25, 2026, 6:30 AM EDT

Why it matters: PHP runs an estimated 69% of websites, per NBC, and Wiz says AI made it far easier to exploit longstanding flaws. The foundation behind it has one full-time staffer.

For information only, not investment advice.

Two critical flaws in PHP, the programming language behind an estimated 69% of websites, set off a global patching scramble this week. The bugs were found by Wiz Research, which says frontier AI models substantially reduced the barrier to turning the longstanding flaws into a working exploit. Wiz says every PHP version released in the last decade is affected.

Government agencies from the FBI and the National Security Agency to European and Australian authorities urged websites to go dark until they could patch, and dozens of major sites did, NBC News reported. The US cybersecurity agency CISA said organizations that can't update right away should take PHP-based systems offline.

In the first days, the damage looked limited. Nine security companies told NBC that as of Thursday evening they had not seen any successful attacks. Experts said the flaws are hard to exploit: Trail of Bits CEO Dan Guido said it took a 10-year veteran on his staff an entire day to do it with an advanced AI model. But one threat researcher told NBC her team has seen over 200 examples of proof-of-concept exploit code and said active exploits are "only a matter of time."

Meanwhile, the nonprofit PHP Foundation has one full-time staff member and 14 mostly part-time contractors, Executive Director Elizabeth Barron told Reuters. "Given that reliance, it is clear that PHP is incredibly under-funded," she said.

Tags: ai