OpenAI acknowledged the breakthrough and the severity of the findings in a dedicated blog post, describing the exposure as one of the most impactful security issues in recent memory. The research teams emphasized that the advanced analytical capabilities of frontier AI models were essential in making the discovery and validation process practically viable. Wiz explained that using these frontier models enabled researchers to systematically develop and adapt working exploits across multiple real-world software applications within a matter of hours—a task that historically required weeks or months of specialized engineering effort.
The potential reach of the vulnerability is exceptionally broad due to the deeply embedded role that PHP plays across global web architecture. First created as a server-side scripting language tailored specifically for dynamic web development, PHP is executed on web servers to compute logic, interact with databases, and assemble the final content that users view when navigating to a web address. While not every website on the internet relies on the language, it nevertheless forms the foundational framework for an overwhelming majority of online platforms. Cybersecurity firm Wiz has estimated that roughly 70 percent of the entire internet is powered by or relies upon PHP, although news agencies, including the BBC, have noted that this specific figure cannot be independently verified.
Security analysts across the tech sector agree that PHP’s omnipresence creates a massive attack surface for potential exploits. Cyber-security company Huntress highlighted the sheer scale of exposure, explaining that PHP quietly powers the underlying software of standard content management systems such as WordPress, Drupal, and Joomla, alongside major enterprise e-commerce platforms like Magento. Furthermore, the language serves as the core framework for web hosting platforms, server control panels, and a vast body of custom web software that operates in the background without explicitly advertising its underlying reliance on PHP.
The technical severity of the newly identified vulnerabilities stems from their potential to allow unauthenticated remote code execution. Security assessments conducted by the European Union Computer Emergency Response Team (CERT-EU) revealed that the risk scores assigned to these vulnerabilities indicate a high probability of remote code execution without requiring prior user authentication or system privileges. In practice, a successful unauthenticated remote code execution attack allows an unauthorized external hacker to remotely inject and execute arbitrary commands directly on a targeted server. Such access empowers attackers to install persistent malware, manipulate internal databases, hijack network operations, or completely collapse dynamic web services.
Evidence suggests that malicious entities are already moving quickly to capitalize on the discovery. Dane Knecht, chief technology officer at internet infrastructure and security firm Cloudflare, publicly confirmed that automated attack vectors are actively taking shape across global network streams. Knecht stated that security teams are observing early attacks emerging in the wild and are continuously updating defensive mitigations and firewall rules as new exploit vectors surface across their network infrastructure.
