Websites Go Dark Worldwide as AI Uncovers Critical PHP Security Flaws
Websites Go Dark Worldwide as AI Uncovers Critical PHP Security Flaws
October 22, 2026: Government agencies, businesses and online platforms around the world temporarily took websites and digital services offline after two critical security vulnerabilities were discovered in PHP, a programming language widely used to power websites.
The flaws raised concerns because PHP supports a large portion of the internet, including systems used by online stores, news organisations and public services.
Cybersecurity firm Wiz estimates that PHP is used by approximately 70 per cent of websites worldwide. However, the vulnerabilities affect systems running PHP on their own servers rather than every website automatically.
Critical Vulnerabilities Raise Security Concerns
According to the report, the vulnerabilities could allow attackers to gain unauthorised access to web servers and potentially reach sensitive files or databases without requiring a password.
The US National Security Agency urged organisations to install the available security updates immediately or temporarily take vulnerable systems offline.
Security experts warned that the flaws could have serious consequences if exploited, particularly for organisations operating systems that had not yet been patched.
AI Helps Researchers Discover Security Flaws
The discovery highlights the growing role of artificial intelligence in cybersecurity research.
Security firm Calif reportedly identified the vulnerabilities in August with the assistance of OpenAI's GPT-5.6 Sol model during an audit of PHP's code funded by OpenAI.
Wiz subsequently discovered the flaws independently, using AI models including Google's Gemini 4 Argon and GPT-5.6 Sol, according to the report.
Researchers' growing ability to analyse software with AI is helping uncover weaknesses that could otherwise remain undetected. At the same time, the faster discovery of vulnerabilities creates additional pressure on developers and organisations to respond quickly.
PHP Developers Release a Security Fix
PHP developers released a patch on Wednesday, urging users to update their systems as soon as possible.
The vulnerabilities had been reported privately to the developers while a fix was prepared. However, details reportedly leaked online on Tuesday, before the planned release, prompting organisations to take precautionary measures.
Security updates are particularly important for organisations that manage their own servers and are responsible for maintaining their software environments.
Government Websites and Online Services Affected
Several countries reported precautionary shutdowns or service disruptions as organisations worked to secure their systems.
In France, local government websites, including a Paris police website, were made inaccessible following a request from the French National Cybersecurity Agency, according to the country's interior ministry.
In the Netherlands, the DigiD digital identity service, the House of Representatives website and the national cybersecurity centre's website were taken offline as a precaution, Dutch public broadcaster NOS reported.
In Australia, the Australian Signals Directorate said its cyber.gov.au website was among the government websites affected, according to ABC.
The Wikimedia Foundation, which operates Wikipedia, also warned users of possible disruptions while it addressed the vulnerabilities and took some supporting services offline for security reasons.
Several gaming services were affected as well. These included Pokémon HOME, Pokémon Champions and Pokémon Sleep, which reportedly underwent emergency maintenance. The operator of the Japanese game Umamusume also announced maintenance related to a PHP vulnerability.
Why Immediate Software Updates Matter
The incident demonstrates how a vulnerability in widely used software can affect organisations across multiple countries and industries.
Although not every website uses PHP, organisations running vulnerable versions need to review their systems, apply the relevant security patches and confirm that their services are operating securely.
The growing use of AI in cybersecurity is creating new opportunities to detect software weaknesses, but it also means organisations must be prepared to respond to security disclosures and updates more quickly.
For website owners and system administrators, keeping software up to date remains an essential part of protecting servers, databases and online services.
Source: Based on a report by AFP published in Khaleej Times. Technical details and affected services should be checked against official PHP security advisories and relevant cybersecurity agency announcements.
Related News
