Websites go offline worldwide after AI-assisted discovery of two critical PHP flaws
Government agencies and companies took sites down on Wednesday while a fix was rolled out for bugs in the language behind a large share of the web.
The Global Sun Desk ·
Government bodies and businesses in several countries pulled websites offline on Wednesday, 21 October, after two serious security holes were disclosed in PHP, a programming language on which a great many sites are built. America's National Security Agency told organisations to patch straight away, or to disconnect exposed systems until they could.
The PHP Foundation, which funds developers of the language, published a fix the same day. "If you run PHP, it is imperative that you update now," it said in a blog post.
What the flaws allow
In a post on X, the NSA said the bugs frequently open a direct route into a server's files or its database. They let an attacker seize control of a web server with no password at all. Wiz, one of the security companies that uncovered them, put PHP's reach at about 70 per cent of websites worldwide.
The risk applies only to sites running PHP on servers they manage themselves. Many large platforms use other languages, or depend on providers able to apply the patch rapidly, so they stayed up. TechCrunch reported that the weaknesses have been present in every PHP release since version 5 in 2004, that PHP 8.1 and earlier no longer receive support, and that the advised remedy is an upgrade to the current release, 8.5.12.
WordPress said the issue does not come from its own code, but that sites using its software still need their servers patched, which means working with their hosting companies.
Found with the help of AI
The security firm Calif discovered the bugs in August with OpenAI's GPT-5.6 Sol model, during an audit of PHP's code that OpenAI paid for. Weeks afterwards, Wiz, which Google owns, reached the same findings on its own, using AI models, among them GPT-5.6 Sol and Google's own Gemini 4 Argon. Each firm worked with the PHP Foundation on repairs before making the flaws public. OpenAI said researchers got there before criminals, and TechCrunch noted that no exploits in the wild had been reported.
The planned secrecy broke down when details surfaced online on Tuesday, a day ahead of the scheduled release of the patch, and that triggered the scramble to shut sites. Wiz cautioned that AI models can help attackers tailor an exploit to different PHP versions, setups and memory layouts, which lowers a hurdle that once made flaws like these hard to use.
Who was affected
French local-authority websites, among them the Paris police site, were made unreachable at the request of the country's national cybersecurity agency. In the Netherlands, the DigiD identity service and the lower house's site went dark as a precaution, Dutch broadcaster NOS reported. Australia's cyber.gov.au was among government sites hit, according to the Australian Signals Directorate. Wikipedia's operator, the Wikimedia Foundation, warned of possible disruption while it fixed supporting services.
Volker Dusch, a security engineer with the PHP Foundation, described the episode to the Wall Street Journal as the gravest problem the language had faced in over ten years, likening it to Heartbleed, the 2014 bug that sent the industry racing to patch.
The episode arrives amid a rise in software flaws surfaced by ever more capable AI models. The Hindu said 2026 is heading for roughly twice last year's record number of disclosed vulnerabilities. Ethan Mollick, a Wharton School professor who studies AI, said firms he speaks with find it hard to match the speed of updates that AI-driven attacks call for. He wrote on X that consumers will soon face the same experience of "getting everything updated often and fast".