AI-Found PHP Flaws Force Governments Worldwide to Pull Websites Offline

Image: Collected

Government, school and hospital websites across Europe went dark on Wednesday as administrators rushed to patch two critical vulnerabilities in PHP, the programming language that powers a large share of the internet. The flaws, nicknamed “PHP2Shell,” can let attackers run malicious code on a web server without logging in.

A global security scramble

The Netherlands took down several major public services, including the Port of Rotterdam, the government portal Overheid.nl and numerous hospital websites. Finland’s state IT provider Valtori suspended government web services, while authorities in France, Belgium, Denmark and the United Kingdom also removed or restricted access to affected sites as a precaution.

Parts of Wikipedia, 4chan and DeviantArt were also disrupted. In the United States, the NSA, FBI and CISA urged organizations to install emergency updates immediately—or take vulnerable systems offline until they could be secured.

PHP2Shell refers to two critical vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619. Both received a severity score of 9.2 out of 10, and either flaw could allow an unauthenticated attacker to execute code on a server, potentially exposing sensitive files, databases and wider networks.

The NSA warned that the flaws “often provide a direct path to the server’s file system or database.” PHP developers released fixes in PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, urging all users to update without delay.

AI found what humans missed

OpenAI said it led a coalition that spent two months investigating the flaws, calling the discovery “one of the most impactful security issues in recent memory.” Security firm Calif found one vulnerability using an OpenAI model, while Google-owned Wiz independently identified the bugs with AI assistance.

Wiz said the weakness had remained hidden for roughly 20 years because exploiting it required a complex chain of steps “at the edge of what human researchers could practically achieve.” The episode highlights a growing shift in cybersecurity: AI is increasingly able to uncover severe software flaws before attackers—or defenders—find them manually.

Attacks already emerging

Cloudflare reported early signs of exploitation, later recording spikes of thousands of attempted attacks. Amazon Threat Intelligence said PHP2Shell was “now being broadly exploited in the wild,” though CISA said it had not yet confirmed exploitation.

“What changed wasn’t the underlying code, but the ability to find those weaknesses and turn them into working exploits,” said Ismael Valenzuela of cybersecurity firm Arctic Wolf.

What website owners should do

Update PHP immediately to version 8.5.12, 8.4.27, 8.3.36 or 8.2.35.

Take unsupported or unpatchable PHP-based systems offline until they can be secured.

Review web servers, content-management systems and third-party plugins for signs of compromise.

Apply vendor security updates and monitor logs for unusual administrative activity or remote-code execution attempts.

The incident shows how a single vulnerability in foundational web software can trigger worldwide disruption—and how AI is now changing both the speed of discovery and the urgency of the response.