Global Websites Go Dark Following Critical PHP Flaws Uncovered By Artificial Intelligence
Government and corporate websites around the world temporarily went dark and suspended services as operators scrambled to patch critical vulnerabilities in PHP, the programming language that powers 70 per cent of all websites globally, including major content management systems like WordPress and Drupal.
The U.S. National Security Agency and Europe’s cybersecurity agency advised organizations to take immediate action regarding two critical flaws in the software. The bugs, collectively named PHP2Shell, allow remote code execution, service disruption, and the exposure of sensitive customer data stored in server memory. The PHP Foundation released a patch for the vulnerabilities, which had remained hidden in the codebase for more than a decade before discovery in late August.
Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.
Governments and Global Airlines Suspend Services During Security Fixes
Government portals in France, Denmark, Finland, and the Netherlands—including the Dutch cybersecurity agency—were temporarily taken offline to implement the required security updates. A U.K. government spokesperson told reporters that work was underway across the government to identify and fix potential vulnerabilities, noting that while no large public-facing critical services were affected, limited services experienced temporary outages. In Japan, Prime Minister Sanae Takaichi urged companies on X to check their infrastructure and consider suspending services if necessary, while major enterprises including airline ANA, railway operator JR West, and the country’s largest bank, MUFG, reported temporary web suspensions.
Commercial impact stretched across industries. Nigel Green, CEO of financial advisory firm deVere Group, warned that the exposure reaches nearly everywhere people spend money online, noting that booking platforms, ticketing sites, delivery apps, and utility portals built on PHP could be holding vulnerable card details.
Frontier AI Models Reduce Months of Research to a Single Week
The discovery marks a turning point in cybersecurity as artificial intelligence was used to find and patch flaws that evaded human detection for years. According to Wiz, researchers deployed Google’s Gemini 4 Argon, Wiz Atlas, and OpenAI’s GPT-5.6 Sol to complete complex chains of steps at the edge of human capability. With frontier AI models and the appropriate tooling, a single researcher completed work in one week that previously required a world-class team months to execute.
Cloudflare, which collaborated with the PHP Foundation, Calif, OpenAI, and Wiz to address the issue, reported that its network observed millions of attempts to exploit the vulnerabilities in the days following public disclosure. Patrick Fussell, global head of adversary simulation at IBM, compared the memory flaw to a hotel room security failure: Think of a hotel room where you check out, but your key still works. And so you can just go back into that hotel room later, and now somebody else’s stuff is there.
Frequently Asked Questions About the PHP2Shell Vulnerability
Which organizations and agencies issued urgent advisories about the PHP flaws?
The U.S. National Security Agency and Europe’s cybersecurity agency issued immediate action advisories for companies utilizing the PHP programming language. National leaders including Dutch Prime Minister Rob Jetten and Japanese Prime Minister Sanae Takaichi publicly urged organizations to monitor the situation and apply patches promptly.
How long were the underlying bugs present in the PHP codebase?
According to research teams from Wiz and OpenAI, the underlying flaws remained hidden in the PHP software for more than a decade before being discovered in late August and publicly disclosed on Wednesday.
What specific AI models were used by researchers during the discovery process?
Wiz researchers utilized Google’s Gemini 4 Argon, Wiz Atlas, and OpenAI’s GPT-5.6 Sol during the investigation and remediation process.
More on Sanae Takaichi
Related reading