AI Tools Uncover Decade-Old PHP Vulnerabilities, Prompting Global Web Shutdowns
Critical security flaws in the PHP programming language, undetected for over a decade and discovered by AI tools, have forced governments and major organizations worldwide to take websites offline while emergency patches are applied.
Critical cyber-security vulnerabilities in the PHP programming language were discovered in October 2026 by AI tools used by researchers at the firms Calif and Wiz. The flaws, which had remained undetected for more than a decade, prompted a global scramble to contain the fallout and apply emergency fixes.
Wiz described the issues as the "most severe vulnerabilities ever discovered" by AI technology, while OpenAI called the discovery "one of the most impactful security issues in recent memory." Both Calif and the PHP Foundation participated in an OpenAI program called Patch the Planet. According to Wiz, roughly 70% of the internet is affected by the vulnerabilities. Paul Spain, chief executive of Gorilla Cyber Security, explained that PHP powers platforms including online shops, Wikipedia, and WordPress.
The European Union Computer Emergency Response Team (CERT-EU) indicated that risk scores suggest potential for unauthenticated remote code execution, and stated the vulnerability could affect all versions of PHP dating back to PHP 5, which launched in 2004. Details of the flaw leaked on social media on Tuesday, forcing the PHP Foundation to rush out its announcement and fix. A patch was issued on Wednesday afternoon, though updates were provided only for the latest versions, with users of PHP 8.1 or older urged to upgrade.
Multiple cyber-security agencies urged organizations unable to apply fixes in time to consider taking their sites down. The US National Security Agency advised organizations to take systems offline if they could not update, and the White House said federal agencies were working with leading AI labs to speed up a fix. Japan's Prime Minister Sanae Takaichi urged people to check if their publicly available websites ran on PHP.
The warnings led to widespread service suspensions. Finland temporarily shut down the government's public web services. In the Netherlands, the national cyber-security agency took its own website offline, the National Institute for Public Health and the Environment took down its website, and the site of the Tweede Kamer, the lower house of the Dutch parliament, became inaccessible. Edinburgh Council's website also became inaccessible.
The Wikimedia Foundation took down a number of systems as a precautionary measure, affecting access to parts of Wikipedia. Online homes for several BBC programmes, including Doctor Who and The Traitors, were taken offline. The art platform DeviantArt stated it was temporarily down for maintenance without specifying the reason.
Dane Knecht, CTO at Cloudflare, reported seeing early attacks emerging. Cyber-security expert Don Smith from Sophos Counter Threat Unit warned this would likely be a priority target for hackers. Jill Slay, a cyber-security researcher from the University of Adelaide, stated it would be disastrous if hackers weaponised the flaw.