AI Uncovers Critical PHP Flaws, Triggering International Security Scramble

Government websites across Europe were taken offline Wednesday after researchers using artificial intelligence uncovered critical vulnerabilities in PHP, a technology estimated to power up to 70% of websites.

Cybersecurity agencies in Europe, Australia, Japan and the U.K. urged operators to install emergency updates immediately or suspend websites until they could be patched.

PHP developers released four patches addressing two critical vulnerabilities that could let attackers execute unauthorized code on exposed systems.

The shutdowns reached government portals, hospitals and national digital services, underscoring the disruption caused by a security flaw in software embedded across the internet.

Public Services Taken Offline

Finland’s state IT provider Valtori disconnected government public network services as a precaution. France’s Interior Ministry placed all its websites into preventive maintenance.

In the Netherlands, the National Cyber Security Center took its own website offline.

Other organizations that suspended websites included the Port of Rotterdam, government portal Overheid.nl, the national soccer association, the five largest political parties and several hospitals.

Denmark’s municipal IT company Kombit shut down services including the national school communication platform.

Wikipedia’s operator also withdrew an unspecified number of systems pending patches, while Japan’s Sakura Internet suspended a database appliance function.

The U.S. National Security Agency advised organizations unable to update immediately to take affected systems offline.

It warned that the vulnerabilities could give attackers access to server files or databases.

Race to Protect Servers

The vulnerabilities, collectively described in the reporting as PHP2Shell, involve weaknesses in PHP’s memory management.

Researchers demonstrated ways to manipulate affected servers into running unauthorized software, with some attacks taking seconds on smaller systems.

Compromised servers could expose information or be used to attack website visitors.

PHP is embedded in platforms including WordPress, Drupal, Joomla and Magento.

W3Techs puts its share at roughly 75% of websites whose server-side programming language can be identified.

Security specialists warned that publishing patches also gives attackers a route to studying the flaws.

AI tools could accelerate that analysis, shortening the time available for website operators to protect their systems.

Some technology companies warned that exploitation was already occurring.

The U.S. Cybersecurity and Infrastructure Security Agency said it had not observed exploitation when it published its advisory, but urged immediate action.

“While CISA has not observed exploitation of these vulnerabilities as of the time of publication, they pose a risk to organizations if left unpatched,” it said.

Earlier Warning Went Unresolved

Calif researcher Ryan Austin uncovered the flaws during an August audit supported by OpenAI, using its GPT-5.6 Sol model.

Google’s Wiz independently developed exploits and worked with PHP, Calif and OpenAI on research and patch verification.

Wiz said AI had reduced the difficulty of exploiting longstanding weaknesses.

“Pre-AI, this manual work would be difficult to implement and even harder to scale,” the company said.

The PHP Foundation acknowledged that a researcher had identified early signs of one flaw in 2024, but no concrete attack methods had been established and other issues took priority.

It described the delay as “a structural failure.”

Developers changed close to 200 files and wrote more than 10,000 lines of code during the patching effort.

A release originally planned for October 22 was brought forward after news of the update leaked Tuesday.

Small websites with limited technical support could remain exposed longer, particularly where shared hosting arrangements leave customers dependent on providers to update the underlying servers.