Critical PHP vulnerability discovered with AI: how we protected our clients' websites

One particularly interesting aspect is that these vulnerabilities were identified by cybersecurity researchers with the help of AI agents and models. The discovery is considered one of the most significant in recent years because of its global reach and severity.

It is a sign of where digital security is heading: AI speeds up finding flaws, but it can also speed up attempts to exploit them. That is why keeping a website updated is no longer optional.

PHP is the language behind many popular platforms. WordPress, the most used content management system in the world, depends on PHP. So do frameworks like Laravel, which we use for custom platforms, portals and web applications.

If your website or platform uses any of these technologies, you need to review installed versions, servers and their configurations. This is not a bug in one particular website: it is an international vulnerability requiring the work of technology and cybersecurity teams worldwide.

Our development team worked preventively and methodically:

• We studied the official PHP, WordPress and Laravel advisories.
• We identified which websites and platforms used affected versions.
• We reviewed servers, PHP versions and configurations.
• We applied the necessary security updates.
• We validated every website and platform after the changes.

All of this work happened on the back end and on the servers. Public websites kept working normally while we completed the review, and we kept our clients informed throughout the process.

• Which PHP version your server runs and whether it already has the security update.
• Whether your website uses WordPress, Laravel or another PHP-based platform.
• Whether your hosting provider has already applied the fixes.
• That plugins, themes and dependencies are up to date.
• That you have recent backups and someone responsible for maintenance.

If you are unsure about any of these answers, now is a good time to ask for a review.

These are the official alerts we used as reference:

• PHP.net: security announcement
• WordPress: Critical PHP Security Release
• Laravel: PHP critical vulnerability response

The news also received wide international coverage:

• NPR: Hacking attempts rise after PHP flaws
• BBC News: Websites taken down worldwide as critical PHP update issued
• The Guardian: Flaw in PHP leads to shutdown of websites
• WIRED: Critical PHP Vulnerabilities Are Setting the Internet on Fire

If your website or platform uses PHP and you are not sure it is protected, we can help you review it. We assess versions, servers and configurations, and recommend the next steps.

Write to us or request a proposal + and we will help you keep your website secure and up to date.