Websites scramble to fix security flaw
On Thursday, numerous websites in Asia and globally experienced outages as cybersecurity teams scrambled to defend against potential breaches following the discovery of severe vulnerabilities in PHP—a widely used open-source scripting language. According to Wiz Research, PHP powers roughly 70% of the world’s websites, making it a prime target for exploitation. The flaws were uncovered through artificial intelligence tools, raising alarms about the growing threat posed by AI-driven cybersecurity risks.
Developed in the early 1990s, PHP initially represented “personal home page” but currently denotes “hypertext preprocessor” and operates beneath widely-used web development platforms. A Wiz blog post stated, “These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history.”
Severity of the Flaws
Advanced AI systems are now capable of detecting weaknesses in backend software code that humans had overlooked for years. This development has intensified cybersecurity concerns, as the count of software vulnerabilities identified globally in 2026 is expected to nearly double compared to last year’s record-breaking number.
On Wednesday, PHP developers deployed a patch, while the U.S. National Security Agency advised organizations to update their systems immediately or disconnect vulnerable infrastructure—a recommendation supported by officials from Japan to the European Union. A platform affiliated with China’s Ministry of Industry and Information Technology urged the same, warning of “two critical remote code execution vulnerabilities with severe impact” in PHP.
Websites hosting PHP on their own servers are the only ones affected. Many major platforms operate on alternative programming languages or utilize operators capable of deploying fixes rapidly, allowing them to remain functional. Rahat Masood, a cybersecurity senior lecturer at the University of New South Wales in Sydney, characterized the issue as “quite devastating.”
According to Masood’s comments to AFP, the vulnerability could enable “attackers to get into your servers without any authorisation, without any username or password.” She further noted that once inside, intruders can perform any action, ranging from extracting sensitive data to altering website content, and urged institutions to “treat it seriously.”
Impact on Websites
From Australia to Finland and the Netherlands, government websites went offline, while services provided by insurers, transportation companies, and media organizations underwent emergency maintenance. Certain popular applications, such as a Pokémon sleep monitoring app, were temporarily suspended during the update process, and the organization managing Wikipedia alerted users about potential disruptions while resolving the issues.
“If you run PHP, it is imperative that you update now,” the PHP Foundation, which funds developers working on the language, said in a blog post. Security firm Calif found the flaws in August using OpenAI’s GPT-5.6 Sol model, as part of an OpenAI-funded audit of PHP’s code. OpenAI said the discovery “marks a new phase, where AI can find security bugs with internet-scale impact.” Wiz, which is owned by Google, said it found them independently weeks later with help from AI models, including Google’s Gemini 4 Argon and GPT-5.6 Sol.
The vulnerabilities were privately disclosed to PHP’s developers and remained confidential until a fix was ready. However, details surfaced online on Tuesday, one day ahead of the scheduled patch release, sparking an urgent effort to take websites offline before malicious actors could exploit them. Steve Kerrison, a cybersecurity senior lecturer at James Cook University’s Singapore campus, told AFP that concerns over hackers leveraging AI to rapidly exploit the PHP flaws contributed to the urgency of the response.
So far, there has been little evidence of damaging attacks, although data breaches could lead to a wave of so-called “phishing” attacks, where hackers use personal details to steal passwords, down the line. Larger institutions, from government agencies to news outlets, should be able to fix their websites relatively fast, Kerrison said; but others may be left vulnerable.
