AI Helps Fix Critical Flaw Hidden in Web Code for 10 Years

Security researchers just used artificial intelligence to find and fix critical vulnerabilities that had been lurking in the code powering most of the internet for more than 10 years.

The team at Wiz Research discovered serious flaws in PHP, the programming language that runs WordPress, Wikipedia, and 70% of all websites worldwide. Working with AI models, they identified problems that human researchers had missed for over a decade, then helped create a fix before criminals could exploit them.

PHP released the patch on October 21, 2026, protecting millions of websites. The vulnerabilities affected every PHP version going back to 2012, potentially allowing attackers to steal passwords, authentication tokens, and sensitive data from affected servers.

What makes this discovery encouraging is how quickly the security community mobilized once the problem was identified. Companies like Cloudflare, Google, Microsoft, and AWS worked together to protect customers who couldn't immediately update their systems.

The research team used frontier AI models to accomplish something that would have taken human experts months or possibly years. The vulnerabilities were extremely complex, requiring researchers to chain multiple flaws together in ways that pushed the limits of what people could practically achieve alone.

The Bright Side

This story marks a turning point in how we can use AI for defense rather than just worry about it being used for attacks. The same technology that could make hacking easier also helped researchers find and fix problems faster than ever before.

The collaborative response was equally impressive. The PHP team, OpenAI, and security companies across the industry coordinated to verify the patch and deploy protections. Major web platforms worked together to ensure their customers stayed safe during the transition.

This cross-industry effort demonstrates that when the security community acts quickly and cooperatively, even decade-old vulnerabilities affecting billions of users can be addressed before causing widespread harm. Companies like Automattic, Akamai, Vercel, and Imperva provided out-of-the-box mitigations for organizations needing extra time to update.

The researchers chose to use their AI-assisted discovery for good, reporting the issues responsibly and working with the PHP team to create comprehensive fixes. Their approach shows how emerging technology can strengthen our digital infrastructure when guided by ethical security practices.

While the vulnerabilities were serious, the swift response prevented what could have been a catastrophic situation for the web, proving that cooperation and advanced tools can protect us all.