Numerous PHP-powered websites temporarily went dark after the AI-assisted discovery of critical vulnerabilities
Numerous websites worldwide, including government-run pages, temporarily went dark after the AI-assisted discovery of critical vulnerabilities in the PHP programming language, which powers around 70% of the web globally.
On Wednesday, the developers of the popular open-source programming language, which helps websites run and display content, issued an urgent security alert over “critical remote code execution vulnerabilities.”
The flaws could allow hackers to take control of affected websites, prompting the release of urgent fixes, with all PHP users “strongly encouraged to update immediately.”
Cybersecurity agencies worldwide, including the US Cybersecurity and Infrastructure Security Agency, the European Union Agency for Cybersecurity, the UK’s National Cyber Security Center, the Australian Signals Directorate, and the Canadian Center for Cyber Security, issued their own alerts, advising users to apply the patches immediately and prioritize internet-facing systems.
Read more Trump and US tech giants sign pact to stop AI from going rogue (VIDEOS)
Organizations that were unable to update immediately or that relied on outdated, unsupported PHP versions were advised to take their systems offline until the fixes could be applied.
The announcement prompted France’s Interior Ministry to temporarily shut down prefecture websites, with local government pages also unavailable. In neighboring Belgium, the Foreign Ministry similarly took its websites offline on Wednesday. In the Netherlands, the National Cyber Security Center, the websites of all major political parties, and at least one port took similar precautionary measures.
In Denmark, the national school communication platform was temporarily shut down; in Finland, the government’s public web services went dark.
Read more This is how we lose control of AI – one successful task at a time
Disruptions also affected services operated by the Wikimedia Foundation, which runs the online encyclopedia Wikipedia.
The flaws in PHP were identified by two cybersecurity companies, Calif and Wiz, in August. PHP developers have since worked on fixes, while keeping the discovery under wraps to prevent malicious actors from exploiting the vulnerabilities.
The cybersecurity companies said they made extensive use of AI models in the process, including Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol.
Wiz stated that the “underlying flaws had been present for decades, but demonstrating their exploitability required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve.”
READ MORE: World ‘should accept some bad things’ from AI – OpenAI CEO
OpenAI described the case as “one of the most impactful security issues in recent memory,” and predicted that more flaws would be discovered in the coming months with the help of AI.