AI-Found PHP Flaw Forces Government Sites Offline

A critical PHP vulnerability has pushed government websites in Europe and Canada offline or left them partly unavailable as public agencies scramble to install patches. The flaw, dubbed PHP2Shell, could let attackers run code remotely, expose customer data, steal information, disrupt services, seize servers or deface websites.

PHP powers an estimated 70% of websites or websites and web applications, though that figure doesn't mean every site faces risk. Ismael Valenzuela, vice president of labs, threat research and intelligence at cybersecurity firm Arctic Wolf, said PHP powers roughly 70% of websites where the server-side programming language is known. “The potential impact is enormous,” he said.

Public services go dark

On Wednesday, the Finnish government's website remained partly available. A message said government websites were fully or partly unavailable as officials worked to resolve the issue. UPI reported that governmental bodies in France, Denmark, Finland and the Netherlands took public-facing sites offline for emergency updates. The New York Times reported that some European government sites became unavailable after agencies told organizations to go offline if they couldn't apply a patch.

The National Security Agency advised organizations using PHP to update or take affected systems offline if they couldn't patch right away. The FBI's cyber division also recommended taking websites offline when operators couldn't apply an update promptly. Governments in the United States, Europe and Asia warned organizations that rely on PHP to install updates. Britain's National Cyber Security Center urged organizations to “take immediate action to mitigate a security issue affecting PHP.”

Japan's prime minister, Sanae Takaichi, posted on social media: “We have an urgent request for everyone to take action tonight. If it is difficult to apply the fix patch promptly, temporarily suspending websites and similar measures can be considered an effective way to reduce risk.”

The PHP Foundation released patches and urged website operators to update their systems immediately. Experts said the public release of fixes also gives hackers information they could use to reverse-engineer patches and attack systems before operators protect them.

Private researchers, public consequences

Teams at OpenAI, Google-owned cybersecurity company Wiz and cybersecurity company Calif worked on the discovery. Researchers found the bugs in late August and disclosed them publicly on Wednesday, Oct. 21, after PHP had a fix. OpenAI said it led a coalition of researchers, security providers and others working on PHP vulnerabilities over the previous two months.

“PHP's maintainers led the fixes and release, with our teams and partners like Wiz, Cloudflare, and others contributing research, technical support, and coordination to prepare protections ahead of disclosure,” OpenAI said. Wiz researchers used Google's Gemini 4 Argon, Wiz Atlas and OpenAI's GPT-5.6 Sol.

Wiz researchers said: “With frontier AI models and the right tools, a single researcher completed in a week what previously would have taken a world-class team months of work.” They compared PHP2Shell with the Heartbleed bug from 2014, which affected an encryption technology estimated to be used by two-thirds of the Web and let cybercriminals access protected data.

The researchers said the flaws had existed for years, but AI made them practical to exploit. “The underlying flaws had been present for decades, but demonstrating their exploitability required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve,” they wrote. “Frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit.”

A growing role for AI and government

OpenAI called the flaws “one of the most impactful security issues in recent memory” and said AI appeared to find them before attackers did. The company also warned that AI's ability to uncover vulnerabilities could help attackers rapidly develop offensive tools and exploits.

OpenAI said: “As significant as they are, these bugs are among several significant vulnerabilities we've already found and are working to fix, and we expect similar findings to increase sharply in the coming months.” Greg Brockman, president and second-in-command at OpenAI, wrote that the PHP fix process was slow and manual and wouldn't work as more exploits emerge; he suggested governments might need a much larger role in monitoring internet infrastructure and possibly fixing vulnerabilities on other servers.

Cloudflare said the flaws could allow remote code execution, disrupt services and expose customer data. Cloudflare Chief Technology Officer Dane Knecht said some attempts to exploit the vulnerabilities were already underway: “We are seeing early attacks emerging and are updating mitigations as new vectors show up. This is a STOPGAP only. Patch as soon as PHP releases the update.”

Raghu Nandakumara, vice president of industry Strategy at cybersecurity company Illumio, described the challenge: “We want AI to move quickly enough to find vulnerabilities humans might miss, while also making sure that increasingly autonomous systems operate within boundaries we understand and control.” He added that speed without control creates a new kind of security problem. The immediate response has drawn on private technology and security firms, PHP's maintainers, and government agencies advising organizations whether to patch or take services offline.