Global Websites Go Offline After AI Uncovers Severe PHP Security Vulnerabilities
Artificial intelligence uncovered critical security flaws in PHP, a programming language powering approximately 70% of the world’s websites, prompting governments and enterprises worldwide to take servers offline preventatively, reported on October 22, 2026.
In the United Kingdom, a senior technology official confirmed that 32 government services went offline due to precautionary measures, though many subsequently resumed normal operations. Created in the early 1990s, PHP serves as the dynamic backbone of internet infrastructure by generating real-time content, managing databases, and handling user login sessions. Major content management platforms including WordPress, Drupal, and PrestaShop rely on the language.
Advanced AI Models Expose Hidden Flaws
Cybersecurity firm Wiz Research and company Calif utilized cutting-edge AI models from U.S. giants OpenAI and Google to unearth the hidden software weaknesses in August. Researchers maintained strict secrecy around the discoveries until software fixes could be developed and deployed. OpenAI characterized the milestone as a new stage where artificial intelligence can detect security flaws on an internet-wide scale. Calif uncovered its set of vulnerabilities during an audit of the PHP codebase funded by OpenAI.
The U.S. National Security Agency warned that the newly discovered flaws often grant direct access to server file systems and databases. This vulnerability potentially allows malicious actors to execute server takeovers without entering a password.
Unresolved Threats in Third-Party Interfaces
Security researchers emphasize that taking websites offline is a responsible defensive posture rather than an indicator of a successful breach. Ryan Austin, a researcher who worked on the language for Calif, told the BBC that widespread exploitation does not appear to have occurred. However, Amazon Threat Intelligence reported detecting an attempt to exploit the vulnerabilities prior to the official public disclosure, though the origin is unknown.
Complex online ecosystems that integrate third-party software interfaces face lingering risks even after core PHP patches are applied. Experts advise that organizations must maintain multi-layered defense strategies to protect digital assets against evolving software threats.
More on Wiz Research
Related reading