For over a decade, serious vulnerabilities remained hidden within PHP, a programming language that underpins vast portions of the internet. The discovery of these flaws by artificial intelligence triggered an unprecedented global cyber-security response on Wednesday, with governments and security agencies worldwide urging website operators to apply emergency patches or take their systems offline immediately.
According to BBC News, cyber-security firm Wiz, one of the companies whose researchers uncovered the vulnerabilities, described the flaws as the "most severe" ever detected by AI. OpenAI, whose technology was instrumental in finding the flaws, called the discovery "one of the most impactful security issues in recent memory". The vulnerabilities affect PHP versions 5.4 through 8.5.11, according to Google Cloud, and are tracked as CVE-2026-109618 and CVE-2026-109619, both receiving a critical CVSS severity score of 9.2.
This incident represents a watershed moment in how artificial intelligence is reshaping cyber-security, both in detecting threats and potentially in enabling attackers to exploit them. The scale of the exposure has forced a coordinated international response that continues to unfold.
What is PHP and why is it so critical?
Most people may not have heard of PHP—short for PHP: Hypertext Preprocessor—but they interact with it daily. The language powers a vast ecosystem of platforms, including online shops, Wikipedia and WordPress, the content management system behind countless websites and blogs. When you visit a website like Wikipedia, PHP is the underlying code that retrieves the information you need and presents it in a readable format on your screen, according to Paul Spain, chief executive of Gorilla Cyber Security, speaking to BBC News.
The newly discovered flaw could allow attackers to take control of affected web servers without authentication and steal sensitive data, leaving everything built on PHP potentially exposed. AI could make such attacks easier and faster, Spain estimated that the flaw could affect "millions and millions" of websites. Jill Slay, a cyber-security researcher from the University of Adelaide, warned it would be "disastrous" if hackers or hostile nations weaponised the flaw to seize private data from websites.
The underlying technical issue involves use-after-free bugs related to memory handling. Google's analysis indicates that one vulnerability involves partially initialized request data following an out-of-memory condition, while the other involves stale request state after memory is freed.
Which major organisations have been forced to take action?
The alert has disrupted services globally, affecting gaming platforms, government portals and online forums. Wikimedia, the organisation behind Wikipedia, took down a number of its systems as a precautionary measure. The Finnish government, Edinburgh council and the BBC all took sites offline, with the Netherlands' cyber-security agency also pulling its website.
Scotland's public sector has been particularly affected, with a number of councils and health boards taking their websites offline. Some experts warn that the vulnerability leaves poorly maintained websites—particularly those belonging to smaller organisations with limited security resources—at significantly greater risk. Salil Kanhere, a cyber-security researcher from UNSW Sydney, cautioned that more exploitation attempts are likely in the coming weeks since technical details are now public.
What response have developers and authorities issued?
On Wednesday, the developers of the PHP platform rolled out patches to fix the vulnerabilities that had persisted in their software for years.
"All PHP users are strongly encouraged to update immediately,"the company stated. Canada's Cyber Centre lists fixed releases as PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; PHP 8.1 and earlier are end-of-life and have no fixes available.
Authorities and security organisations worldwide have echoed these warnings. The US National Security Agency instructed all organisations using PHP to take their systems offline if unable to patch them immediately, adding that the flaw could provide a
"direct path" to exploit a system's database. The agency stated that
"These risks are serious enough to require immediate patching across United States Government departments and agencies."
The UK's National Cyber Security Centre provided similar guidance, instructing organisations to check for
"backdoors installed by an attacker". Counterparts in the EU and Australia issued comparable alerts. The EU agencies' joint statement advises isolating exposed applications from public networks if immediate patching is not feasible.
Japanese Prime Minister Sanae Takaichi urged citizens to check whether their publicly available websites ran on PHP.
"We have an urgent request for everyone to take action tonight,"Takaichi wrote on X.
"If it is difficult to apply the fix patch promptly, temporarily suspending websites and similar measures can be considered an effective way to reduce risk,"she added.
How did artificial intelligence uncover these long-hidden flaws?
The vulnerabilities were discovered by cyber-security researchers at the security firms Calif and Wiz. The researchers employed advanced AI tools capable of analysing code and identifying flaws far more rapidly than humans or legacy systems could achieve. Kanhere explained that
"Modern software is incredibly complex, and some vulnerabilities can remain undetected for years. The underlying bugs weren't new; what changed was our ability to find them."
The flaws were reported to PHP in August, with Calif reporting one on August 11 and Wiz reporting the other on August 24, according to reporting from Al Jazeera. The public release followed a coordinated effort to prepare fixes. Details of the discovery leaked online this week, forcing the PHP platform's developers to accelerate their announcement of the security flaw and its massive scope.
OpenAI noted in a blog post that the incident
"highlights how AI can uncover security flaws"but also how it can
"help attackers rapidly develop offensive tools and exploits."The ChatGPT-maker released a program to check whether the PHP platform is secure. Ryan Ko, at the University of Queensland's Cyber Research Centre, observed that
"Many of these flaws stem from the way software were built in the past, which were built for functionality and not with security in mind."
What is the current status of active exploitation?
Uncertainty remains about the extent of real-world attacks. Patchstack reported receiving reports of active exploitation, while the Cybersecurity and Infrastructure Security Agency (CISA) stated it had not observed exploitation as of its advisory's publication, leaving the true scope of any attacks unclear.
What steps should website owners and users take now?
Website owners are being urged to secure their platforms with the latest version of PHP. The US National Security Agency has urged
"heightened awareness"in the coming weeks and close monitoring of updates from software vendors.
"Vigilance in applying patches related to those systems is paramount,"the agency stated.
Organisations should identify PHP-based applications, prioritise internet-facing systems, coordinate with hosting providers and apply the released security updates. Those unable to patch promptly should isolate exposed applications from public networks. The responsibility lies primarily with website operators, but users should remain alert for any security advice issued by affected services, such as requests to change passwords, Kanhere advised. He also warned people to watch for phishing messages exploiting the publicity surrounding the incident.
