New York:Two critical security flaws in PHP, a programming language used by millions of websites, have triggered an urgent cybersecurity response after researchers employed artificial intelligence (AI) to uncover vulnerabilities that could allow attackers to take control of web servers.

According to Anadolu Agency – English, the flaws affect PHP, which is widely used to build and run websites, including platforms such as WordPress, Drupal, and Joomla. The PHP developers released emergency security updates on October 21, urging immediate installation to prevent attackers from running malicious code on affected servers without needing to log in.

Cloudflare, a cybersecurity company, reported observing attack traffic targeting its customers following the leaks of the flaw details before their official announcement. New Zealand's National Cyber Security Centre acknowledged reports of active exploitation. In response, the US, British, EU, and Australian cybersecurity authorities issued urgent warnings, and some organizations temporarily took websites offline as a precaution.

The incident is viewed as a turning point in cybersecurity. AI helped identify vulnerabilities that had previously evaded detection, but there is concern that the same technology could enable quicker exploitation by attackers. The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, involve how PHP handles computer memory and could potentially allow attackers to run their own code on servers.

PHP developers have released four updated versions to address the flaws, and organizations are being urged to update immediately as there are no complete mitigations available. Meanwhile, AI tools continue to play a crucial role in both identifying and potentially exploiting vulnerabilities, highlighting the dual-use nature of this technology.