AI discovery of PHP flaws triggers global website outages

A global digital outage

Several Australian government websites, including the Australian Bureau of Statistics and Jobs and Skills Australia, were recently taken offline or experienced outages. This occurred following the discovery of two critical vulnerabilities in PHP, an open-source programming language widely used to build websites.

The Australian Signals Directorate (ASD) confirmed it was aware of the outages and noted that work was being done to mitigate the risks. While the ASD stated it was not aware of any active exploitation, the Australian Cyber Security Centre (ACSC) urged organizations to identify PHP in their environments and apply security patches immediately.

The impact of these flaws was not limited to Australia. Government websites in Europe, as well as high-traffic platforms like Wikipedia and the Internet Archive, were also affected by the vulnerabilities. Operators were forced to take action quickly to prevent unauthorized access to their systems.

How AI found the flaws

The vulnerabilities were identified with the help of generative AI systems by cybersecurity companies Calif and Wiz. Calif reported finding the bugs in August using a large language model (LLM). Wiz used its own AI vulnerability research tool, Wiz Atlas, along with Google's Gemini 4 Argon and OpenAI's GPT-5.6 Sol.

According to Wiz researchers, the underlying flaws had been present for decades. However, proving that these flaws could actually be used by a hacker required a sequence of steps so complex that they were at the edge of what human researchers could practically achieve. The researchers noted that frontier AI models substantially reduced this barrier, turning a long-standing flaw into a functional exploit.

The flaws are particularly dangerous because they could allow a remote attacker to execute code on a server or read sensitive process memory. This memory might contain high-value information such as passwords, authentication tokens, API keys, and digital certificates belonging to the server or other requests.

The risk to open source

PHP is a foundational technology for the internet, estimated to be used on around 70 per cent of the world's websites and web applications. Because it is so widely adopted, a vulnerability in the core language can have a massive ripple effect across the global economy.

Gunnar Hellekson, a vice president and general manager at Red Hat, noted that much of the critical software running the world is often the least visible. He warned that stable production code that simply works is now at risk because of the speed and volume of new vulnerabilities being found through AI-driven discovery.

The situation serves as a reminder of how deeply open-source software is woven into global business systems. When a flaw is found in a core component like PHP, it can expose thousands of different organizations simultaneously, regardless of their individual security posture.

A wake-up call for security

The Australian Information Security Association (AISA) described the AI-assisted discovery as a wake-up call. They explained that vulnerabilities which might have remained hidden for years can now be identified much more quickly by both researchers and potential attackers. This creates a new environment where the speed of exploitation is significantly increased.

Scarlett McDermott, a board director at AISA, emphasized that if organizations do not know exactly what software they are running, they cannot know if they are vulnerable. She noted that the ability to identify affected systems quickly is now the most critical factor in being able to patch them before they are exploited.

The discovery also highlighted the importance of responsible disclosure. Because details of the PHP vulnerabilities were leaked on social media earlier this week, researchers were forced to publish their findings sooner than they had planned. This underscores the need for cooperation between the research community and software developers to ensure fixes are deployed safely and efficiently.

What comes next

The Australian government is currently reviewing its cybersecurity posture following incidents where AI agents accessed both public and non-public data on government websites. This ongoing review may lead to stricter guidelines on how AI tools are used to interact with government infrastructure.

For the broader tech community, the focus is shifting toward how to defend against AI-driven discovery. As AI makes vulnerability research more accessible, security teams must move toward automated patching and more rigorous inventory management of all software components. The goal is to ensure that as the tools for finding bugs get faster, the tools for fixing them keep pace.

The path forward

Organizations using PHP must act immediately to secure their infrastructure. The Australian Signals Directorate has released an alert recommending that companies identify all PHP instances, review official guidance, and apply the latest security updates as soon as possible. Monitoring for suspicious activity on these applications is also highly recommended.

This event marks a turning point in cybersecurity, where the primary challenge is no longer just finding the