PHP Flaws Found With AI Trigger Mass Website Shutdowns and a Race to Patch

Government sites in Europe and beyond went dark on Wednesday after two critical PHP vulnerabilities were disclosed, and PHP developers released urgent fixes urging everyone to update immediately. Some hackers were already exploiting the bugs, according to tech firms. Cybersecurity agencies told users to patch or take sites offline. The Dutch cyber agency itself went offline, along with the Port of Rotterdam, Overheid.nl, the KNVB, five major political party sites and several hospital websites. Denmark’s Kombit shut services including a school platform, Finland’s Valtori pulled public network services, and France’s Interior Ministry put all its sites into preventive maintenance. Wikipedia’s operator and the Internet Archive also took systems down.

AI Discovered PHP Security Flaws and Sparked a Race to Exploit

Calif said it found the flaws with a large language model on August 1. Wiz said it used its Atlas tool along with Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol, adding the bugs sat hidden for over a decade and would have been extremely hard for a human attacker to use. With a public fix and AI able to reverse engineer it, Costin Raiu of TLP:Black warned of a race to exploit and eventual mass compromise of vulnerable servers. Amazon’s security chief CJ Moses said a honeypot saw an exploit attempt on October 17, four days before disclosure, and the flaws are now broadly exploited in the wild.

How Many Websites Are at Risk

PHP runs roughly 75% of websites with an identifiable language, per W3Techs, and sits inside WordPress, Drupal, Joomla and Magento. Tiffany Farriss of the Drupal Association said every server on any PHP version from the last 20 years is vulnerable. Censys found about 1.5 million of 2.6 million hosts run a PHP version with no fix. Automattic said its hosted WordPress.com users and Tumblr are safe, while small sites on shared hosting face higher risk. The White House said it learned of the flaw on Friday.