AI Uncovers Critical PHP Vulnerability, Triggering Global Cybersecurity Crisis

Thumbnail Image

The information displayed in the AIM should not be reported as representing the official views of the OECD or of its member countries.

AI systems, including OpenAI's GPT-5.6 Sol and Google's Gemini 4 Argon, uncovered two critical security vulnerabilities in PHP, a language powering most websites. The discovery led to widespread cyberattacks, forcing government, banking, and public service sites offline worldwide, and prompting emergency security patches and global cybersecurity alerts.[AI generated]

Why's our monitor labelling this an incident or hazard?

The event explicitly involves AI systems used to discover a critical security vulnerability in PHP, which is a foundational technology for many websites. The vulnerability has caused real harm by forcing many sites to shut down temporarily, disrupting services globally, and exposing sensitive data to potential theft. The AI's role is pivotal in both uncovering the flaw and the potential for misuse by attackers. The harms include disruption of critical infrastructure (websites and online services), potential data breaches (harm to property and communities), and security risks. This meets the criteria for an AI Incident because the AI system's use has directly led to significant harm and disruption.[AI generated]
AI principles
Robustness & digital securitySafety

Industries
Digital securityFinancial and insurance services

Affected stakeholders
GovernmentBusiness

Harm types
Economic/PropertyPublic interest

AI system task:
Reasoning with knowledge structures/planning


Articles about this incident or hazard