PHP Vulnerabilities in the AI Era: 3 Immediate Steps for Website Owners

Yonaton Keller, a product manager at Zafran Security, told Business Insider that two disclosed PHP vulnerabilities created a serious situation because PHP is used across a large share of websites and web applications. He said the flaws required essentially no authentication from an attacker, raising the risk for internet-facing assets.

The added pressure is the AI era: Keller said AI can improve detection and response, but it can also help limited-technical attackers exploit vulnerabilities within minutes. The practical takeaway for website owners is to treat PHP exposure as urgent, not theoretical.

Keller’s first recommendation is to review websites and web applications to understand where PHP is involved. He said most sites are likely to use PHP in some way unless they are very basic HTML-based pages.

Start with internet-facing assets and identify which applications, plugins, services, or hosted pages rely on PHP. This gives teams a clear scope before they move into scanning and patching.

The second step is to look at what online vulnerability scanners are reporting. Keller named Tenable, Qualys, and Rapid7 as major sources for releasing detection rules and identifying vulnerabilities.

Use scanner findings to understand the exact exposure across internet-facing assets. This helps prioritize the systems that need immediate attention instead of relying on assumptions alone.

After identifying exposure and reviewing scanner data, Keller said site owners should look online to upgrade to the current PHP version. He described the upgrade as free, though some technical follow-up may require help from a technical specialist.

Keller said taking a site fully offline can be the right emergency move if there is evidence it is being targeted, but it should not be the default response for everyone. The broader risk is not just disruption: he said attackers could take control of a server, steal sensitive documents, move inside a network, or carry out malicious operations such as ransomware.

Keller said the situation had calmed somewhat, but his team remained concerned because patching widely used software across the web takes time. He also said exploitation attempts appeared online within hours after the PHP Foundation disclosed a fix.

His broader warning is that traditional remediation timelines are under strain when attackers can move quickly. For organizations, the implication is to invest more in pre-compromise defenses so response plans and protections are ready before the next emergency.