AI Finds PHP Flaws, Sites Go Dark Across Europe

Researchers identified critical vulnerabilities in PHP, the open-source programming language used by an estimated 70% of websites, with help from artificial-intelligence tools. The warnings that followed have already pushed some government sites offline. The flaws, collectively called PHP2Shell, could let attackers run code remotely, read memory that may contain passwords, disrupt services, and take control of servers. That 70% figure doesn't mean every website is exposed, and recent data cited by the New York Times suggests PHP's adoption is waning.

The Discovery and the Fix

Teams at OpenAI, the Google-owned cybersecurity company Wiz, and the cybersecurity company Calif worked on the discovery. Wiz researchers used Google's Gemini 4 Argon, Wiz Atlas, and OpenAI's GPT-5.6 Sol. Researchers found the bugs in late August and disclosed them publicly Wednesday, Oct. 21, after they had already put a fix in place. OpenAI said it led a coalition of researchers, security providers, and others that had worked on the problem for the previous two months.

"PHP's maintainers led the fixes and release, with our teams and partners like Wiz, Cloudflare, and others contributing research, technical support, and coordination to prepare protections ahead of disclosure," OpenAI said. The PHP Foundation released patches and urged website operators to update their systems immediately. Experts warned that publishing fixes also gives hackers a roadmap. Attackers can reverse-engineer the patches and target systems that haven't been updated yet.

Government Response and Shutdowns

The National Security Agency told organizations using PHP to update or take affected systems offline if they couldn't patch immediately. The FBI's cyber division recommended the same step. Britain's National Cyber Security Center urged organizations to "take immediate action to mitigate a security issue affecting PHP." The U.S. government and governments in Europe and Asia issued similar warnings.

The warnings quickly hit public websites. The Finnish government's website was only partly available Wednesday, with a notice saying government websites were fully or partially unavailable while officials resolved the issue. UPI reported that governmental bodies in France, Denmark, Finland, and the Netherlands took public-facing sites down for emergency updates. The New York Times reported that some European government sites became unavailable after agencies advised organizations to go offline if they couldn't apply a patch. Japan's prime minister, Sanae Takaichi, made a similar appeal on social media. "We have an urgent request for everyone to take action tonight," she said. "If it is difficult to apply the fix patch promptly, temporarily suspending websites and similar measures can be considered an effective way to reduce risk."

Security Implications

Wiz researchers described the episode in stark terms. "With frontier AI models and the right tools, a single researcher completed in a week what previously would have taken a world-class team months of work." They compared it with the Heartbleed bug from 2014, which affected an encryption technology estimated to be used by two-thirds of the Web. The PHP flaws themselves weren't new. "The underlying flaws had been present for decades, but demonstrating their exploitability required an exceptionally complex chain of steps," the researchers wrote. "Frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit."

Cloudflare, which worked with the PHP Foundation, Calif, OpenAI, and Wiz, said the flaws could permit remote code execution and expose customer data. Its chief technology officer, Dane Knecht, said attacks were already underway. "We are seeing early attacks emerging and are updating mitigations as new vectors show up. This is a STOPGAP only. Patch as soon as PHP releases the update."

Ismael Valenzuela, vice president of labs, threat research and intelligence at the cybersecurity firm Arctic Wolf, called the potential impact "enormous." He said it put a "significant portion of the internet's business and commercial infrastructure at potential risk," while stressing that not all websites are vulnerable. Some weaknesses, he added, had existed for more than a decade. "What changed wasn't the underlying code, but the ability to find those weaknesses and turn them into working exploits."

Raghu Nandakumara, vice president of industry strategy at the cybersecurity company Illumio, laid out the tension. "We want AI to move quickly enough to find vulnerabilities humans might miss, while also making sure that increasingly autonomous systems operate within boundaries we understand and control." He added that "speed without control creates a new kind of security problem."

Why This Matters: Businesses and taxpayers are feeling the PHP episode at the same time, and the bill is hard to ignore. Companies that can't patch quickly face a choice between exposure and lost revenue from taking their sites offline; government agencies in several countries have already chosen the second option. Those outages carry their own costs: services citizens can't reach and staff hours spent on emergency work. The episode also raises an uncomfortable question about who can respond when software flaws turn up faster than anyone can fix them. Greg Brockman, president of OpenAI, wrote that the PHP fix process was slow and manual and wouldn't hold up as more exploits emerge. He suggested governments might need a far larger role in monitoring internet infrastructure. Those who prefer that private firms, software maintainers, and individual website operators keep primary responsibility for their systems should scrutinize that proposal closely. Expanding state oversight of the internet would bring costs and risks of its own. This week's stronger lesson may be that resilient systems, prompt private patching, and clear operator accountability are worth more than new layers of government control.