Global Cyber Alert: AI Uncovers Critical PHP Vulnerabilities, Disrupting Websites Worldwide

Governments and companies globally took websites and online services offline on Thursday to prevent cyberattacks following the discovery of two severe security flaws in the PHP programming language, which powers a significant portion of the internet. The vulnerabilities, identified with the help of artificial intelligence systems, triggered a worldwide race to patch vulnerable systems. According to cybersecurity firm Wiz, which was among those that identified the flaws, PHP is used by approximately 70% of global websites, including e-commerce sites, news outlets, and government services. However, not all sites using PHP are susceptible to these specific vulnerabilities. Wiz described them as "among the most serious security vulnerabilities ever discovered in PHP, and perhaps in the history of software."

The U.S. National Security Agency (NSA) urged immediate installation of a security update released Wednesday or disconnection of vulnerable systems. Similar calls were issued in Japan and the European Union. China's Ministry of Industry and Information Technology also warned of critical flaws enabling remote code execution and potential severe damage. Dr. Rehat Masood, a Senior Lecturer in Cybersecurity at the University of New South Wales in Sydney, called the discovery "quite devastating," explaining that attackers could gain unauthorized access without credentials, enabling them to steal sensitive data, alter website content, or take control of systems. Australian, Finnish, and Dutch government websites were among those taken offline, alongside insurance companies, transport operators, and media organizations performing urgent maintenance. Even popular applications were temporarily disabled.

The vulnerabilities were first detected in August by cybersecurity firm Calif using OpenAI's GPT-5.6 Sol AI model during a security audit of PHP's source code, funded by OpenAI. Calif stated this marks a new phase where AI can find internet-scale impact vulnerabilities. Israeli firm Wiz, owned by Google, independently discovered the same flaws weeks later using AI models like Google's Gemini 4 Argon and OpenAI's GPT-5.6 Sol. The vulnerabilities were initially reported confidentially to PHP developers, with information kept secret while a patch was prepared. However, details leaked online Tuesday, a day before the planned fix release, intensifying fears of exploitation before systems could be updated and accelerating the global website shutdowns.

Steve Crison, a Senior Lecturer in Cybersecurity at James Cook University's Singapore campus, cited the fear of AI being used for rapid exploitation as a key reason for the urgent response. While evidence of actual damage remains limited, experts warn that data leaks could lead to a surge in phishing attacks. Crison noted that large institutions are likely to patch systems quickly, but smaller websites and private blogs may remain vulnerable for extended periods, potentially becoming conduits for malware, spam, and malicious content. The PHP Foundation, which funds PHP developers, announced, "If you are running PHP, you must update now," with security engineer Volker Dux calling it the most severe security issue in PHP in over a decade, comparable to the 2014 Heartbleed vulnerability.