Governments and companies around the world shut down websites Thursday as they raced to protect themselves from hacks after artificial intelligence uncovered critical flaws in a widely used programming language called PHP.
PHP helps run about 70 percent of the world’s websites — from online stores and news outlets to government services — according to Wiz Research, one of the cybersecurity firms that found the two flaws.
Created in the early 1990s, PHP originally stood for “personal home page” but now means “hypertext preprocessor” and sits underneath popular web design platforms.
Quick Fact
| Detail | Information |
|---|---|
| What happened | AI assisted researchers in discovering two critical PHP security vulnerabilities. |
| Where | Worldwide, affecting potentially vulnerable PHP based websites and applications. |
| When | Public disclosure and security updates occurred on October 21, 2026. |
| Who is involved | PHP developers, OpenAI, Calif, Wiz, Google, and cybersecurity authorities. |
| Current status | Security patches are available, and organisations have been urged to update affected systems. |
| Why it matters | The flaws could expose servers to unauthorised code execution and sensitive data theft. |
AI Uncovers Critical PHP Security Vulnerabilities
“These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history,” a Wiz blog post stated.
Growing AI models are able to identify vulnerabilities in back-end computer code that people have been blind to for years.
The amount of software flaws found globally in 2026 is expected to nearly exceed last year’s record level, which has increased concerns about cybersecurity.
The US National Security Agency advised firms to patch their websites right now or take susceptible systems down after PHP programmers published a fix on Wednesday. Authorities from China to the European Union reiterated this advice.
Global Websites Shut Down Over PHP Security Flaws
Threat Intelligence, a hacking attempt was discovered prior to the PHP security vulnerabilities being made public.
The event was described as the “targeting of a honeypot” via an anonymous internet connection. “It remains unclear how the actor acquired exploit information,” the statement stated.
The only websites that are vulnerable are those that use PHP on their own servers. Many major platforms utilize operators that could swiftly apply the update and remain online, or they are constructed on other programming languages.
She warned AFP that it may enable “attackers to get into your servers without any authorization, without any username or password.”
The websites of government agencies in Finland, the Netherlands, the United Kingdom, Australia, and other nations went black. Due to emergency repair, services from media outlets, insurance companies, and transportation companies were unavailable.
While the update was being made, popular apps, such as a Pokemon sleep tracker, were also momentarily pulled down, and the foundation that powers Wikipedia alerted users that they would experience outages.The PHP Foundation, which provides funding for PHP developers, stated in a blog post that if you use PHP, you must upgrade right now.
AI Detects Critical Bugs, Leaked Details Trigger Urgency
According to OpenAI, the finding “marks a new phase, where AI can find security bugs with internet-scale impact.”
Google-owned Wiz claimed to have discovered them on its own a few weeks later using AI models including Google’s Gemini 4 Argon and GPT-5.6 Sol.
AI increases urgency
A day before the update was scheduled to be released, information leaked online on Tuesday, causing a scramble to pull websites offline before hackers could take advantage of them.
Experts Warn of Ongoing PHP Security Risks
Steve Kerrison, a senior cybersecurity lecturer at James Cook University’s Singapore campus, told AFP that the haste to respond was fueled by the worry that hackers would use AI to swiftly and easily attack the PHP flaws.
“There are sites, systems and people out there who will have no idea about and still won’t for days, weeks and months,” Kerrison cautioned, adding that while larger organizations, such as government agencies and news outlets, should be able to fix their websites rather quickly, others might be left vulnerable.
This might include user-run blogs that could be used as a weapon to spam people and distribute computer viruses.
