AI Discovery of Critical PHP Flaws Spurs Global Cybersecurity Warnings

Government agencies and companies around the world shut down websites Wednesday after two critical flaws came to light involving PHP, a programming language that is the basis for a large share of the internet. The US National Security Agency told organisations to patch immediately or pull vulnerable systems offline. The flaws "often provide a direct path to the server's file system or database," the NSA said in a statement on X. PHP sits underneath popular web design platforms so the weaknesses potentially affect a vast range of websites, from online stores and news outlets to government services. The discovery came amid a surge in software security disclosures driven by increasingly powerful AI models, with the number of vulnerabilities found in 2026 on track to roughly double last year's record total. "If you run PHP, it is imperative that you update now," the PHP Foundation, which funds developers working on the language, said in a blog post. The flaws were reported in August by security firm Calif and by ChatGPT maker OpenAI, which flagged them independently on the same day. Google-owned cloud security company Wiz later reported further ways to exploit them. The flaws had been reported privately to PHP's developers at the time and kept confidential while a fix was prepared. Details leaked online Tuesday, a day before the planned release, prompting the rush to take sites offline. In France, local government websites, including the Paris Police Prefecture, have been inaccessible since Wednesday afternoon at the request of the French National Cybersecurity Agency, following "detection of a critical security vulnerability," the Ministry of the Interior said. In the Netherlands, the national digital identity service DigiD, the website of the House of Representatives and the site of the national cybersecurity center went offline as a precaution, according to Dutch public broadcaster NOS. Belgium's foreign ministry temporarily took its websites offline as a precaution, it said on X, although the Centre for Cybersecurity Belgium had recorded no attacks on Belgian sites.