AI Finds Flaws Hiding in the Code Behind 70% of Websites

The vulnerabilities affect PHP, a programming language used by nearly 70% of websites whose server-side language is known, according to Oct. 21 data from W3Techs, a web technology survey, Newsweek reported. Wiz researchers warned that attackers could exploit the flaws to take control of vulnerable servers, steal sensitive information or deface websites, PYMNTS reported. Still, the discovery does not mean every website using PHP is vulnerable. Exposure depends on the PHP version and how each system is configured, according to Newsweek.

For financial institutions, the danger extends beyond their core banking systems. Customer portals, merchant platforms, payment applications and third-party service providers may depend on software that banks do not directly control.

A compromised website could expose customer information, interrupt transactions or give attackers access to other connected systems.

AI Found Two PHP Flaws Hidden for More Than a Decade

On Wednesday (Oct. 21), the PHP Foundation, the nonprofit that maintains the language, released emergency security updates for two critical vulnerabilities, collectively known as PHP2Shell, according to its security advisory.

Calif, an AI security firm working in OpenAI’s Patch the Planet program, found the first flaw on Aug. 1 using OpenAI’s GPT-5.6 Sol, Fortune reported. Wiz, the Google-owned cloud security firm, found its first flaw independently on Aug. 19 using Google’s Gemini 4 Argon, GPT-5.6 Sol and its own Wiz Atlas research agent. One Wiz researcher did in about a week what once took a world-class team months, Wiz said in a blog post. The flaws had sat in PHP’s code for more than a decade, the company added.

Both flaws carry a 9.2 out of 10 severity rating, CNBC reported.

We’d love to be your preferred source for news.

Please add us to your preferred sources list so our news, data and interviews show up in your feed. Thanks!

Add as Preferred Source

OpenAI warned that the AI tools that find flaws like these “can also help attackers rapidly develop offensive tools and exploits,” PYMNTS reported. But the company said that to its knowledge, frontier AI found these vulnerabilities before attackers did.

PHP Sits Inside Vendor Software Banks Do Not Control

The Cybersecurity and Infrastructure Security Agency (CISA) said PHP is often a component of other software, so organizations may not see where it runs. CISA urged them to update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and take PHP-based systems offline if they cannot.

The FBI advised organizations to inventory where PHP runs, including products that bundle it, Newsweek reported. Wiz said that the flaws sit in PHP itself, so an application with secure code can still be exposed.

A bank’s core transaction-processing system might remain secure while a customer-facing website or third-party service is exposed. For payment processors and merchants, the consequences could include compromised customer data, interrupted checkout services and costly investigations.

Japanese Banks Hit Pause on Online Services

In Japan, several banks suspended services as a precaution. MUFG Bank halted some online banking transactions, and Daiwa Securities began emergency maintenance, Jiji Press reported. Shizuoka Bank disabled its online banking app until it confirms the service is safe and Mizuho’s bank and securities arms halted services, Bloomberg reported. The Japan Bankers Association said the network that settles funds between almost all domestic banks was not affected.

Airlines, railways and retailers followed suit. All Nippon Airways disabled boarding passes in Apple Wallet and said it found no evidence of a breach. Japan Airlines, East Japan Railway and Seven-Eleven Japan took some web services down, The Next Web reported.

Government agencies in the Netherlands, France, Denmark and Finland also took websites offline as a precaution, PYMNTS reported. Taking a vulnerable application offline may prevent an intrusion, but it can interrupt purchases, delay customer service and disrupt revenue-generating operations.