Decades-old flaw discovered in PHP forces govt websites to go offline globally

Government portals, municipal networks and public institutions across Europe and other regions went offline on Wednesday (October 21) after researchers disclosed critical vulnerabilities in PHP, a foundational programming language that powers a vast portion of the global web. The disclosures prompted emergency responses from IT teams worldwide, with operators taking critical servers offline as a defensive shield to prevent malicious intrusions before security updates could be deployed.

Developers of the open-source PHP language published urgent security fixes for flaws that had remained buried inside the language’s codebase for years. Issuing an emergency advisory, the team stated that all site owners and server administrators are “encouraged to update immediately.”With tech security firms warning that malicious actors have already begun targeting unpatched setups, the disclosure triggered an immediate “race to exploit.” As fixes are now public, analysts warned that artificial intelligence (AI) tools could allow hackers to reverse-engineer the vulnerability with minimal effort.“Pre-AI, this manual work would be difficult to implement and even harder to scale.

With AI this is no longer a barrier,” noted cybersecurity firm Wiz, warning that AI-assisted attacks could lead to the mass compromise of unprotected web servers across the internet.Flaw impacting the ‘backbone of the web’Created in the early 1990s as “Personal Home Page,” PHP has evolved into one of the core backbones of modern internet infrastructure. When a user visits a webpage, servers running PHP assemble the text, media and code before serving it to the browser.

According to web analytics tracker W3Techs, PHP underpins roughly 75% of all websites where the server-side language can be identified.“All servers using any version of PHP released in the last 20 years will be vulnerable. This issue impacts the majority of the Internet,” said Tiffany Farriss, interim chief executive of the Drupal Association.Due to this widespread footprint, national cyber agencies across Britain, Europe, Japan and Australia issued advisories directing web administrators to install updates immediately or take public-facing pages offline.Flaw discovered through Artificial IntelligenceThe underlying security flaw sat hidden in the software codebase for over a decade.

In a technical brief, Alphabet-owned cybersecurity firm Wiz revealed that human researchers would have found it extraordinarily complex to locate and exploit through conventional testing. Instead, the vulnerability was surfaced through advanced AI tooling:Wiz discovered the flaw using Wiz Atlas, its autonomous vulnerability discovery system, working alongside Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol.

Wiz collaborated with the PHP core developer team, OpenAI and security firm Calif to verify the bug and confirm remediation patches.Early mitigation protocols were shared with cloud and infrastructure operators, including Google Cloud, Cloudflare, Amazon Web Services (AWS), Microsoft, Automattic (operator of WordPress.com), Fastly, Akamai, Imperva and Vercel.You use AI every day.

Now get your AI Quotient. Take the AIQ test.