Websites go dark after AI exposes major programming language security flaw

Developers released emergency fixes on Wednesday, while cybersecurity authorities urged organisations to update affected systems immediately or take them offline until they could be secured. The vulnerabilities were uncovered with the help of artificial intelligence.

Security firm Calif identified one of the flaws in August during an OpenAI-funded audit of PHP, while Google-owned cybersecurity company Wiz independently discovered and reported both vulnerabilities. OpenAI said its GPT-5.6 Sol model was used in the Calif research.

Severity and Response

The PHP security team rated both vulnerabilities 9.2 out of 10 for severity. Details were meant to remain confidential while developers prepared fixes, but information about the flaws emerged publicly before the planned release, intensifying the race to secure vulnerable systems.

Security researchers initially reported little evidence of widespread exploitation before the vulnerabilities became public. However, attempted attacks have since been detected, increasing concern that unpatched systems could be targeted.

Precautionary Shutdowns

The warning prompted governments, companies and major online services in several countries to temporarily shut down websites and other systems as a precaution. The Wikimedia Foundation, which operates Wikipedia, said it deliberately took a number of supporting services offline while security updates were installed.

Amazon Threat Intelligence also detected attempts to exploit the vulnerabilities, including activity before their public disclosure. Several European governments have taken precautionary action, including France's Interior Ministry and Germany's federal IT provider ITZBund.

Government and public-service websites were also taken offline in countries including the Netherlands and Finland. In the UK, the National Cyber Security Centre urged organisations running PHP to identify vulnerable systems and install updates as soon as possible.