AI uncovers decade-old PHP flaws causing global website outages

A global security scramble

Websites across the globe briefly went dark this week as operators scrambled to fix critical security holes in PHP. PHP is a programming language that serves as the backbone for an estimated 70% of all websites on the internet, including popular content management systems like WordPress and Drupal.

The vulnerabilities, collectively known as PHP2Shell, were discovered by a team of researchers from OpenAI, the cybersecurity firm Wiz, and the company Calif. These flaws were significant enough that the US National Security Agency and Europe's cybersecurity agency issued urgent warnings for companies to take immediate action.

As a result of the news, several high-profile entities took their services offline as a precaution. The Wikimedia Foundation reported taking down systems to address the issues, while the Irish news site The Journal went offline to bolster its defenses. In Japan, major entities including the airline ANA, the railway operator JR West, and the bank MUFG reported temporary service suspensions.

How AI found the hidden flaws

What makes this discovery unique is the role artificial intelligence played in uncovering the bugs. According to Wiz, the flaws had remained hidden in the PHP codebase for more than a decade. While the bugs were present, they were so complex that they were at the edge of what human researchers could practically achieve on their own.

Researchers used frontier AI models—specifically Google's Gemini 4 Argon, Wiz Atlas, and OpenAI's GPT-5.6 Sol—to bridge that gap. The AI was able to understand the underlying weaknesses and turn them into a working exploit. Wiz researchers noted that with these tools, a single researcher could complete in one week what would have previously taken a world-class team months of work.

This shift marks what some experts call an 'AI inflection point' in cybersecurity. It means that while the flaws were old, AI made it practical to actually use them to hack into websites, disrupt services, and expose customer data like passwords.

The impact on global infrastructure

The scale of the PHP vulnerability means that the impact was felt by both private companies and government bodies. Government websites in France, Denmark, Finland, and the Netherlands were temporarily taken offline while security fixes were implemented. Even world leaders weighed in on the severity of the situation.

Dutch Prime Minister Rob Jetten stated that his cabinet was closely monitoring the situation. Japan's Prime Minister Sanae Takaichi urged companies to consider suspending services to reduce their exposure. She specifically advised site owners to check if their publicly available websites use PHP and to prepare to apply the fix patch as soon as possible.

Security experts have compared the severity of PHP2Shell to the 2014 Heartbleed bug. Heartbleed was a major flaw in encryption technology that impacted two-thirds of the web. Like Heartbleed, PHP2Shell could serve as a turning point in how cybercriminals access data that should be protected by standard security measures.

Patching the internet

The PHP Foundation, the organization responsible for the coding language, has already released a patch for the bugs. They are urging all website operators to update their systems immediately to close the door on potential attackers. The flaws were discovered in late August but were only disclosed to the public on Wednesday once a fix was ready.

Cloudflare, a web infrastructure provider, has been working alongside the PHP Foundation, Calif, OpenAI, and Wiz to coordinate the response. Because PHP is so deeply integrated into the modern web, the patching process is a massive undertaking that requires coordination between developers, hosting providers, and government agencies to ensure the continued safety of online data.