The internet runs on software that most people never see. When a weakness appears in one widely used component, the effects can spread far beyond a single website.

That risk came into focus this week after two serious vulnerabilities in PHP triggered a global cybersecurity scramble. Some government websites in Europe went offline as operators rushed to secure their systems.

The incident has also raised a broader concern: artificial intelligence (AI) is making it easier to discover hidden software flaws, but the teams responsible for fixing them may struggle to keep pace.

Also Read | A Ukrainian soldier amputated his own foot to survive. Then came a dramatic drone rescue

The internet’s workhorse has a staffing dilemma

Two serious PHP vulnerabilities sent some European government websites offline
ZOOM IMAGE
Two serious PHP vulnerabilities sent some European government websites offline | AI

PHP is an open-source programming language used to build and run websites. It has been around for nearly three decades and remains a major part of the internet’s infrastructure. It may underpin as many as 70% of websites worldwide.

That widespread use makes security problems particularly serious. A vulnerability in a widely deployed technology can expose organizations across different sectors to risk.

Website operators may need to identify whether their systems use the affected software, install security updates, and check that the fixes have worked.

The recent vulnerabilities also exposed a funding problem. The PHP Foundation, the nonprofit organization supporting the language, has just one full-time employee—executive director Elizabeth Barron.

It also has 14 mostly part-time contractors, while its board members work as unpaid volunteers. Its operations depend on donations and grants.

Barron told Reuters that the foundation works with external researchers and companies, including OpenAI and cybersecurity firms Wiz and Calif, to investigate vulnerabilities and coordinate fixes.

Yet the scale of PHP’s use contrasts sharply with the resources available to maintain it.

How AI is changing cybersecurity

A software vulnerability is a weakness that could allow someone to access a system or make it behave in an unintended way. An exploit is a method or piece of code that takes advantage of that weakness.

Finding such flaws has traditionally required technical expertise and considerable time. Turning a discovery into a working exploit could take weeks or months.

That gap gave developers an opportunity to investigate the problem, prepare a patch, and distribute an update before attackers could take advantage of it.

AI is changing that timeline. Models can examine large codebases repeatedly and identify weaknesses that may have gone unnoticed for years. The PHP flaws had existed for about a decade before researchers discovered them. The same tools can also help attackers develop ways to exploit vulnerabilities more quickly.

Research from cybersecurity firm VulnCheck indicated that the number of digital flaws discovered had doubled year on year, with AI helping drive the increase.

Cloudflare chief executive Matthew Prince also warned that more serious vulnerabilities were being found in other critical software.

The result is a shrinking window for defenders. A flaw can be identified, reported, and potentially weaponized much faster than before. Security teams must then assess its severity, develop or apply a fix, and ensure affected systems are updated.

A discovered flaw is not proof of a breach

The PHP flaws reportedly sat undetected for about a decade | X (@MarioNawfal)
ZOOM IMAGE
The PHP flaws reportedly sat undetected for about a decade | X (@MarioNawfal)

The discovery of a vulnerability does not prove that hackers have exploited it successfully.

Cloudflare reported millions of hacking attempts around the PHP incident. Barron, however, said that the foundation had no evidence the vulnerabilities were exploited before disclosure or on systems that had been patched.

Separately, Cloudflare’s chief executive said he had anecdotal evidence of compromises linked to a PHP vulnerability.

Cybersecurity specialists also disagree on how much the increase in AI-assisted discoveries will translate into successful breaches. Some vulnerabilities are complex and difficult to exploit, even after they become public. Others may create a much more immediate risk.

Also Read | Literary prize for AI-written fiction? France has an interesting offer

AI can flag the flaw, but it cannot fund the fix

VulnCheck says discovered digital flaws doubled year on year, with AI helping drive the rise | X (@TheHackersNews)
ZOOM IMAGE
VulnCheck says discovered digital flaws doubled year on year, with AI helping drive the rise | X (@TheHackersNews)

AI can help developers identify problems and write code more efficiently. But it also creates more work for the people maintaining software. Barron said PHP was receiving nearly twice as many proposed code changes as a year earlier, while the number of contributors had not doubled.

Reviewing those changes and assessing bug reports still requires substantial human expertise.

Finding vulnerabilities faster does not automatically make systems safer. Organizations need enough skilled people, funding, and coordination to verify discoveries, release reliable patches, and help users apply them.

The PHP episode is therefore about more than two software flaws. It highlights a growing mismatch between the speed of AI-assisted discovery and the capacity of the people responsible for keeping essential internet infrastructure secure.