PHP security flaws force global websites to go offline

A widespread digital emergency

On Wednesday, a wave of websites across the globe went dark as security teams scrambled to address two critical flaws in PHP. PHP is a programming language that serves as the backbone for a significant portion of the internet, meaning its stability is vital for everything from news outlets to online shops.

Because the language sits underneath many popular web design platforms, the impact of these vulnerabilities is broad. Organizations were forced to make a difficult choice: keep their services running and risk a breach, or take them offline entirely to ensure safety. As a result, various government agencies and private companies pulled their systems from the web.

The US National Security Agency issued an urgent directive for organizations to either apply a patch immediately or disconnect vulnerable systems. The agency warned that these specific weaknesses could provide a direct path for intruders to reach a server's database or file system. This means an attacker could potentially seize control of a web server without ever needing to provide a password.

The role of AI in discovery

The discovery of these flaws highlights a shift in how software is audited. Security firm Calif first identified the issues in August using OpenAI's GPT-5.6 Sol model during a funded audit of the PHP code. Shortly after, the firm Wiz, which is owned by Google, independently found the same flaws using a combination of AI tools, including Google's Gemini 4 Argon and GPT-5.6 Sol.

This trend reflects a broader surge in software security disclosures driven by the increasing power of artificial intelligence. The number of vulnerabilities identified in 2026 is currently on track to roughly double the record total from the previous year. OpenAI noted that using these tools to find bugs represents a new era where AI can identify security issues that have a massive impact on the entire internet.

The PHP Foundation, the group that funds the developers of the language, emphasized the urgency of the situation. They stated that if you run PHP, it is imperative that you update now. The flaws are considered some of the most serious problems the language has faced in over a decade, with some experts comparing them to the 2014 Heartbleed incident.

Impact on global infrastructure

The reach of the PHP language was evident in the variety of services that were forced to go offline. In France, the interior ministry reported that local government sites, including one for the Paris police, were made inaccessible. Similarly, the Netherlands saw its national digital identity service, DigiD, and the website for the House of Representatives taken offline as a precaution.

In Australia, the Australian Signals Directorate confirmed that its own cyber.gov.au site was among the government websites affected by the flaws. The Wikimedia Foundation, which manages Wikipedia, also warned users of potential outages. They chose to take many supporting services offline until they could be safely updated to protect user data.

The private sector was also heavily impacted. Several popular apps, including various Pokemon titles like Pokemon HOME and Pokemon Sleep, were taken offline for emergency maintenance. Additionally, the operator of the Japanese game Umamusume confirmed they were performing maintenance to fix the PHP vulnerability found on their servers. While large platforms built on different languages remained online, those relying on self-hosted PHP servers faced a high-risk window until the fix was deployed.

The timeline of the leak

The situation escalated quickly due to a leak of information. The flaws were originally reported privately to the PHP developers and kept confidential while a fix was being prepared. However, details about the vulnerabilities leaked online on Tuesday, just one day before the official release of the patch.

This leak created a race against time, as it gave malicious actors a head start on finding ways to exploit the weaknesses. This prompted the immediate rush by government agencies and companies to pull their systems offline before hackers could take advantage of the exposed code. Now that the PHP programmers have released the fix, administrators are working to apply it and bring their services back online safely.

What comes next for PHP

The PHP Foundation is now overseeing the rollout of the patch to ensure that the vast majority of the internet's infrastructure is secured. For developers and IT administrators, the priority is immediate verification of their server configurations to see if they are running the vulnerable versions of the language.

Moving forward, the use of AI in security auditing will likely become a standard practice. While it allows for the rapid identification of critical flaws, it also means that vulnerabilities can be discovered at a much faster pace. This cycle of AI-driven discovery and rapid patching will define the next phase of internet security, requiring organizations to be more agile in how they respond to emerging threats.