How did AI discover the internet's massive cyber-security risk?

Governments and cyber-security agencies around the world are scrambling to contain a massive flaw in internet technology, after artificial intelligence uncovered weaknesses that hackers could have exploited.

The vulnerabilities were found in PHP, the platform that powers more than 70 per cent of the world's websites, including Wikipedia and major digital shopping sites. Its developers have rushed out patches to fix flaws that had been sitting unnoticed in the software for years.

The scale of the discovery has rattled the security industry. Cyber-security firm Wiz described the issue as the "most severe" ever detected, while OpenAI — whose technology was used to find the flaws — called it "one of the most impactful security issues in recent memory."

The find is a vivid example of how AI is changing the hunt for software bugs. Where human researchers once combed through code line by line, machine-learning systems can now scan vast codebases at speed, spotting patterns and weaknesses that might otherwise have gone undetected for years — as these flaws did.

BBC technology correspondent Joe Tidy explains how the AI-driven discovery unfolded and, crucially, what it means for ordinary internet users. With PHP running behind such a huge share of the web, the incident is a reminder of how much of daily online life rests on a small number of shared, open building blocks — and how quickly a single weakness can become everyone's problem.