AI-Found PHP Flaw Forces Government Sites Offline

Government websites in France, Denmark, Finland and the Netherlands went offline or became partly unavailable as agencies rushed to patch a critical PHP vulnerability. Operators were warned to suspend sites if they couldn’t update them promptly.

The PHP Foundation released patches on Wednesday, Oct. 21, and urged website operators to install them immediately. The National Security Agency and the FBI’s cyber division advised organizations to take affected systems offline if they couldn’t apply a fix. Britain’s National Cyber Security Center urged organizations to “take immediate action to mitigate a security issue affecting PHP.”

Institutions and the people who rely on their services face a hard choice: patch quickly, or pull public-facing systems from reach. On Wednesday, the Finnish government’s website was partly available, carrying a message that government websites were fully or partially unavailable while the issue was being resolved. UPI reported that government bodies in France, Denmark, Finland and the Netherlands took down public-facing sites for emergency updates.

Who Holds the Switch

The vulnerabilities, collectively called PHP2Shell, could let attackers execute code remotely, read memory that may contain sensitive information such as passwords, disrupt services, expose customer data, steal data, take control of servers or deface websites. Organizations maintain the infrastructure at risk. The people trying to use it bear the service interruptions.

PHP is used by an estimated 70% of websites or websites and web applications, though that estimate doesn’t mean every site is vulnerable. Recent data cited by the New York Times suggests PHP’s adoption is waning. Ismael Valenzuela, vice president of labs, threat research and intelligence at cybersecurity firm Arctic Wolf, said PHP powers roughly 70% of websites where the server-side programming language is known. “The potential impact is enormous,” he said, describing a “significant portion of the internet’s business and commercial infrastructure” as potentially at risk.

Teams at OpenAI, Google-owned cybersecurity company Wiz and cybersecurity company Calif worked on the discovery. Wiz researchers used Google’s Gemini 4 Argon, Wiz Atlas and OpenAI’s GPT-5.6 Sol. Researchers discovered the bugs in late August and disclosed them publicly Wednesday, after PHP had a fix. OpenAI said it led a coalition of researchers, security providers and others working on PHP vulnerabilities over the previous two months.

“PHP’s maintainers led the fixes and release, with our teams and partners like Wiz, Cloudflare, and others contributing research, technical support, and coordination to prepare protections ahead of disclosure,” OpenAI said. The PHP Foundation issued the patches. Organizations that operate websites still have to install them.

The Patch Comes With a Clock

Public fixes can also give hackers information to reverse-engineer patches and attack systems before operators protect them, experts said. Cloudflare said attempts to exploit the vulnerabilities were already underway. “We are seeing early attacks emerging and are updating mitigations as new vectors show up,” Cloudflare Chief Technology Officer Dane Knecht said. “This is a STOPGAP only. Patch as soon as PHP releases the update.”

Wiz researchers said: “With frontier AI models and the right tools, a single researcher completed in a week what previously would have taken a world-class team months of work.” They compared the issue with the Heartbleed bug from 2014, which affected an encryption technology estimated to be used by two-thirds of the Web and allowed cybercriminals to access protected data.

“The underlying flaws had existed for decades, but demonstrating their exploitability required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve,” the Wiz researchers wrote. “Frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit.”

Who Gets to Set the Safeguards

OpenAI called the flaws “one of the most impactful security issues in recent memory” and said AI appeared to find them before attackers did. The company also warned that AI’s ability to uncover weaknesses could help attackers rapidly develop offensive tools and exploits. Raghu Nandakumara, vice president of industry Strategy at cybersecurity company Illumio, said, “speed without control creates a new kind of security problem.”

Greg Brockman, president and second-in-command at OpenAI, wrote that the PHP fix process was slow and manual and wouldn’t work as more exploits emerge; he suggested governments might need a much larger role in monitoring internet infrastructure and possibly fixing vulnerabilities on other servers. The account describes no election proposal, legislative remedy or community-led response. Instead, it describes government agencies telling organizations when to disconnect, private security companies coordinating protections, and website operators left to carry out the updates. The emergency is technical. The power to decide what stays online is institutional.