Numerous PHP-powered websites temporarily went dark after an AI-assisted discovery of critical vulnerabilities
Numerous websites worldwide, including government-run pages, have temporarily gone dark following an AI-assisted discovery of critical vulnerabilities in the PHP programming language that powers roughly 70% of the web globally.
On Wednesday, the developers of the popular open-source programming language, which helps websites run and display content, issued an urgent security alert over “critical remote code execution vulnerabilities.” The flaws could allow hackers to take control of affected websites, prompting the release of urgent fixes, with all PHP users “strongly encouraged to update immediately.”
Multiple cybersecurity agencies worldwide, including the US Cybersecurity and Infrastructure Security Agency, the European Union Agency for Cybersecurity, the UK’s National Cyber Security Centre, the Australian Signals Directorate, and the Canadian Centre for Cyber Security, issued their own alerts, advising users to apply the patches immediately and prioritize internet-facing systems.
Organizations that were unable to update immediately or that relied on outdated, unsupported PHP versions were advised to take their systems offline until the fixes could be applied.
The announcement prompted France’s Interior Ministry to temporarily shut down prefecture websites, with local government pages also unavailable. In neighboring Belgium, the Foreign Ministry similarly took its websites offline on Wednesday. In the Netherlands, the National Cyber Security Centre, the websites of all major political parties, and at least one port took similar precautionary measures.
In Denmark, the national school communication platform was temporarily shut down, while in Finland, the government’s public web services went dark.
Disruptions also affected services operated by the Wikimedia Foundation, which runs the online encyclopedia Wikipedia.
The flaws in PHP were identified by two cybersecurity companies, Calif and Wiz, back in August. PHP developers have since worked on fixes, while keeping the discovery under wraps to prevent malicious actors from exploiting the vulnerabilities.
The cybersecurity companies said they had made extensive use of artificial intelligence models in the process, including Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol.
In its statement, Wiz noted that the “underlying flaws had been present for decades, but demonstrating their exploitability required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve.”
OpenAI, in turn, described the case as “one of the most impactful security issues in recent memory,” and predicted that more flaws would be discovered in the coming months with the help of AI.
