The internet’s foundational plumbing just sprung a massive leak. Two critical security flaws in PHP, the language powering nearly 70 percent of the web, were disclosed today after being unearthed by AI tools. The discovery has triggered immediate defensive actions across Europe, with government, hospital, and school websites going dark to prevent exploitation. This event marks a sharp pivot from theoretical AI security risks to tangible, infrastructure-level chaos.

The Scale of the Outage

Major entities including the Finnish health agency, the Port of Rotterdam, the Paris police force, and 4Chan have taken their digital services offline. Sam Rubin, a senior vice president at Palo Alto Networks, emphasized that PHP is one of the fundamental pieces of technology supporting the internet. The vulnerabilities, which have existed for over a decade, were only recently detected due to the enhanced pattern recognition capabilities of modern AI models. Hackers are already attempting to exploit these weaknesses, likely using AI to accelerate their attacks, leaving tens of millions of servers exposed.

A Pattern of AI-Powered Breaches

This PHP crisis is the capstone of a weeks-long series of AI-driven cybersecurity incidents. Recent reports indicate that criminals and state-backed attackers have used AI to breach over 100 companies, including John Deere and SharkNinja. Additionally, approximately 400 financial institutions in Latin America have faced automated hacks, and hundreds of thousands of credit-card records were stolen from two separate firms. The rate of identified software vulnerabilities has doubled in the past year, while the time required to exploit them has plummeted from weeks to hours, with some automated intrusions occurring in as little as 39 seconds.

The Asymmetry of Defense

While Google and OpenAI-led efforts discovered the PHP flaws, the defensive response remains hampered by institutional risk aversion. Unlike attackers who can deploy new tools with abandon, defenders like hospitals and utilities cannot afford for AI security systems to cause operational failures. This asymmetry means that while AI helps defenders find holes, it disproportionately empowers attackers who need to find only one vulnerability to succeed. Concurrently, the Node.js platform, used by nearly half of developers, also disclosed multiple high-severity vulnerabilities today, compounding the pressure on dev-ops teams.

Key Takeaways

  • PHP vulnerabilities discovered by AI have caused widespread service outages across European critical infrastructure.
  • The window for exploiting new bugs has shrunk from weeks to hours, with some AI-automated attacks taking under a minute.
  • Defensive AI adoption is slowed by the high risk of false positives disrupting essential services like healthcare and utilities.
  • Recent attacks have targeted over 100 companies and 400 financial institutions using AI-accelerated methodologies.

The Bottom Line

We are no longer in a theoretical 'AI security' phase; we are in a production outage. If your infrastructure relies on PHP or Node, patching speed is now a matter of survival, not just hygiene. The era of leisurely vulnerability management is dead.