LONDON, October 23, 2026 — Websites across the globe went dark on Thursday as governments and businesses raced to patch critical security flaws in PHP, a programming language that powers roughly 70 percent of the world’s web. The vulnerabilities were uncovered by autonomous AI agents, which identified memory safety bugs in the core engine that had remained hidden for over a decade.
The Human Side of the Outage
For the average user, the disruption was immediate and visible. Government agency sites in Australia, Finland, the Netherlands, and the United Kingdom went offline for emergency maintenance. The UK government confirmed it is working closely with OpenAI and international partners on the issue.
The impact extended beyond public services. Services from insurance firms, transport operators, and media outlets were down for emergency maintenance. Even popular consumer applications, including a Pokemon sleep tracker, were temporarily taken offline while the fix was implemented. The foundation that runs Wikipedia warned users they could see outages while it addressed the flaws. For families relying on these digital services for daily tasks, the sudden unavailability highlighted how deeply embedded these systems are in modern life.
AI Bridges the Exploitation Gap
The discovery marks a significant shift in cybersecurity, driven by the capabilities of frontier AI models. Wiz Research, in collaboration with OpenAI, identified multiple critical vulnerabilities in core PHP. These flaws allow for unauthenticated remote code execution and memory disclosure in the PHP engine itself, independent of the application running on top of it. According to Wiz, the underlying flaws had been present for decades, stemming from architecture decisions made over ten years ago.
Historically, demonstrating the exploitability of these specific memory safety bugs required an exceptionally complex chain of steps that sat at the edge of what human researchers could practically achieve. However, frontier AI models substantially reduced that barrier. The AI agents were able to bridge the gap between a latent flaw and a practical exploit, turning a longstanding theoretical risk into an immediate threat. This development illustrates how AI is changing the practical exploitability of longstanding security issues, potentially marking a turning point similar to the Heartbleed or Log4Shell incidents of previous years.
Scope and Severity of the Flaws
The vulnerabilities are grouped under two CVEs, with a severity rating reaching CVSS 9.2. Every PHP version released in the last decade is affected by at least one of these issues, including releases dating back to version 5.4. PHP is the backbone of the web, powering major platforms such as WordPress, Joomla, Drupal, and MediaWiki, which runs Wikipedia. A flaw in its core engine affects websites across this ecosystem, even when their own application code is secure.
Successful exploitation could allow attackers to take control of affected servers, steal sensitive data, and deface websites. The memory disclosure aspect is particularly concerning, as the exposed memory may contain passwords, authentication tokens, API keys, and certificates belonging to other requests or the server itself. Rahat Masood, a senior lecturer in cybersecurity at the University of New South Wales, described the discovery as quite devastating. She noted that it could allow attackers to get into servers without any authorization, username, or password, giving them the ability to do anything they want once inside.
Emergency Response and Current Status
PHP programmers released a fix on Wednesday, October 21, 2026, addressing the multiple memory-safety vulnerabilities in the core engine. The US National Security Agency and the FBI advised organizations to patch their sites immediately or pull vulnerable systems offline. This call was echoed by authorities from China to the European Union. The PHP Foundation emphasized in a blog post that if you run PHP, it is imperative that you update now.
Despite the severity of the threat, widespread exploitation has not yet taken off. Ryan Austin, who has worked on PHP issues for cybersecurity firm Calif, stated that at the moment, it does not look like exploitation has been widespread. However, Amazon Threat Intelligence identified a pre-publication hacking attempt targeting a honeypot. The company noted that it remains unclear how the actor acquired the exploit information, describing the incident as the targeting of a honeypot from an anonymized internet connection. Only sites that run PHP on their own servers are directly exposed, while many large platforms built on other languages or using managed operators were able to stay online by installing the fix quickly.
Sources
- Websites go dark as AI exposes critical security flaws
- Rush is on to patch a software vulnerability that could impact 70% of websites worldwide
- PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet | Wiz Blog
Photo: lmonk72 (CC0)
