AI-Discovered PHP Flaws Force Global Site Shutdowns

Governments and companies across the globe shut down websites on Thursday to protect their systems from potential breaches. This urgent response followed the discovery of severe security vulnerabilities in PHP, a programming language extensively used for web development.

Scope of the Vulnerability

Wiz, a cybersecurity firm that identified two of these flaws, estimates that PHP code powers approximately 70% of internet sites worldwide. The affected infrastructure ranges from e-commerce stores and news outlets to government services. Wiz described the discovered issues as among the most dangerous ever found in PHP, potentially marking a historic moment in software security history.

The risks are primarily concentrated on sites running PHP on their own private servers. Many major platforms continue operating without interruption because they rely on different programming languages or use service providers capable of rapidly installing updates.

Official Responses and Updates

PHP developers released a patch to fix the vulnerabilities on Wednesday. The US National Security Agency urged institutions to update their sites immediately or disconnect vulnerable systems from the internet. Similarly, the Japanese Prime Minister advised companies to act with "a high degree of urgency," while the South Korean government instructed technical departments within organizations to update their software.

In France, access to local administration websites, including the Paris police portal, was disabled at the request of the French National Cybersecurity Agency, according to the Ministry of Interior. The Wikimedia Foundation, which operates Wikipedia, warned users of possible outages while it addressed the flaws. The foundation temporarily disconnected several supporting services to allow time for updating and securing them.

Discovery by Artificial Intelligence

Cybersecurity company Calif discovered the two flaws in August using OpenAI’s GPT-5.6 Sol model during an audit of PHP codes funded by the company. OpenAI stated via the X platform that it considers these vulnerabilities to be among the most impactful memory-security issues in recent history. The company added that this discovery represents a new phase where AI can detect security errors affecting the entire internet scope.

Wiz, owned by Google, announced it independently discovered the same flaws weeks later. This process utilized AI models including Google’s Gemini 4 Argon and GPT-5.6 Sol. Rahat Masood, a senior lecturer in cybersecurity at the University of New South Wales in Sydney, characterized the discovery as "extremely destructive." She told AFP that the flaws could allow attackers to enter servers without any authorization, username, or password. Once inside, attackers could steal sensitive information or modify website content, prompting her call for institutions to treat the matter seriously.

Leakage and Immediate Impact

The vulnerabilities were initially reported secretly to PHP developers to keep details confidential until fixes were ready. However, specifics leaked online on Tuesday, one day before the scheduled update release. This leak forced institutions to rush disconnecting their sites before hackers could exploit the gaps.

Volker Dusch, a security engineer at the PHP Foundation, told the Wall Street Journal that this problem is the most serious facing PHP in over a decade. He compared it to the Heartbleed vulnerability discovered in 2014, which triggered a global wave of system updates. The PHP Foundation, which funds developers working on the language, posted on its blog: "If you are using PHP, it is essential to update now."

Ethan Mollick, a professor at the Wharton School of the University of Pennsylvania specializing in AI studies, noted that companies he communicates with struggle to keep pace with the necessary updates to defend against AI-supported cyberattacks. Writing on X, Mollick observed that consumers will soon experience the same pressure, requiring frequent and rapid updates for all digital products.

Advanced AI models have increasingly become capable of identifying code weaknesses that remained hidden from human experts for decades. This trend has heightened concerns about cybersecurity risks, with projections suggesting the number of software vulnerabilities detected globally in 2026 may approach double last year's record. Affected shutdowns included government sites from Australia to the Netherlands, alongside emergency maintenance operations by insurance firms, transport operators, and media institutions. Popular applications, such as a sleep-tracking app linked to Pokémon, were also temporarily suspended to implement necessary fixes.