Governments and companies around the world shut down their websites on Thursday following the discovery of serious vulnerabilities in the PHP programming language. These vulnerabilities, identified by artificial intelligence, pose a serious threat to the security of many websites.
Details of the vulnerabilities and reactions
Wiz, a cybersecurity company that identified these two vulnerabilities, estimates that PHP powers about 70 percent of the world's websites. These websites include online stores, media outlets, and government services. Wiz has described these vulnerabilities as "very serious" and considered them "among the most severe vulnerabilities discovered in software history."
Read more: NVIDIA's $250 million investment in AI safety research in the UK
PHP developers released a patch on Wednesday, and the U.S. National Security Agency (NSA) advised organizations to patch their websites as soon as possible or take vulnerable systems offline. Websites running PHP on their servers are at risk. Many large platforms use other programming languages or rely on operators who can quickly install patches.
Consequences of the vulnerability discovery
Rahat Masood, a senior cybersecurity professor at the University of New South Wales in Sydney, described this discovery as "very devastating" and stated that this vulnerability could allow attackers to access users' servers without any authorization or username and password. He added, "Once inside the servers, they can do anything they want, including stealing sensitive information or altering website content."
Government websites in various countries, including Australia and the Netherlands, were shut down, while insurance companies, transportation operators, and media outlets also undertook emergency repairs. The Prime Minister of Japan has urged businesses to act "with great urgency," and the South Korean government has advised organizations to update their software. In France, local government websites, including the Paris police website, were shut down at the request of the National Cybersecurity Agency.
These vulnerabilities had been reported privately to PHP developers, and the information was kept confidential until a patch was ready. However, the details were leaked online on Tuesday, a day before the planned release, prompting a hurried shutdown of websites.
Calif Security discovered these vulnerabilities in August using OpenAI's GPT-5.6 Sol model, which was part of an audit of PHP code. Wiz also independently identified these vulnerabilities weeks later with the help of AI models, including Gemini 4 Argon and GPT-5.6 Sol. OpenAI described this discovery as "a new phase" in which AI can identify security flaws with widespread internet implications.
Volker Dush, a security engineer at the PHP Foundation, told the Wall Street Journal that this is the most significant issue PHP has faced in over a decade, comparing it to the Heartbleed vulnerability in 2014 that led to a global patching effort. The number of identified software vulnerabilities worldwide this year is already on track to double last year's record.
Read more: Oman Space Conference focuses on Vision 2040 goals · India successfully tests quantum key distribution platform
