Somewhere under your website, beneath the theme, the CMS, and the plugin you installed in 2019 and forgot about, sits PHP. This week it turned out PHP had a couple of skeletons in its closet, and AI was the one that found them. Governments around the world reacted by pulling the plug on their own websites, which is about as dramatic as patch day gets.

Two 9.2s and a Global Lights-Out

Two critical vulnerabilities in PHP, the language that powers roughly 70% of the world's websites, were made public on Wednesday. The PHP security team rated both 9.2 out of 10, and emergency fixes are out. Cybersecurity startup Calif found one flaw in August during a PHP audit funded by OpenAI, and OpenAI says its GPT-5.6 Sol model was used in that research. Google-owned Wiz independently found and reported both.

The fallout was immediate. Government sites in France, Germany, the Netherlands, and Finland went offline as a precaution, Wikimedia took some supporting services down while it patched, and the UK's National Cyber Security Centre urged organisations to find and update vulnerable systems right away. Exploitation attempts have already been spotted, including some by Amazon Threat Intelligence from before public disclosure, and early details leaked ahead of the planned release date, which made the race even tighter.

Wait, My Drupal Site Runs on That

Yes, it does. Drupal and WordPress are both built on PHP, so this isn't "a WordPress problem" or "a Drupal problem." It's an every-server-running-PHP problem. A CMS can be fully patched and still sit on a vulnerable runtime, so "we updated core last week" doesn't cover you here.

The bigger story is the AI angle. According to Wiz, frontier models helped turn a flaw that had been hiding for more than a decade into a working exploit, and one researcher got done in a week what would normally take a top team months. Defenders get that speedup too, but so do attackers, and the time between "bug exists" and "bug weaponized" just got a lot shorter.

Patch the runtime, not only the app. This time the call is coming from inside the stack.

If you're not sure which PHP version your Drupal or WordPress site runs, or who's supposed to patch it, our team can check your hosting stack and get it updated before someone else's AI finds it first.

Source: Euronews