Global websites shut down after AI found a critical flaw affecting 70% of the internet

AI-Assisted Security Discovery Forces Urgent PHP Updates Worldwide

Earthguardiansonline.com – Government agencies and businesses in several countries briefly took websites offline on Wednesday as they rushed to address a severe set of PHP vulnerabilities that researchers say could affect roughly 70% of the internet. The flaws, known collectively as PHP2Shell, were identified with significant assistance from advanced artificial intelligence systems.

The issue has drawn attention not only because of the breadth of PHP’s use across the web, but also because it illustrates how AI can change the pace and scale of cybersecurity research. Teams from OpenAI, Google-owned cybersecurity company Wiz, and cybersecurity company Calif worked on the discovery and coordinated the disclosure after a fix became available.

What the PHP2Shell flaws could expose

PHP is a widely used programming language that powers countless websites and web services. The newly disclosed bugs could give an attacker a path to execute code remotely and inspect portions of a system’s memory. Memory exposure can be especially serious because it may contain sensitive material, including passwords and other data that applications are expected to keep protected.

Cloudflare, which worked with the PHP Foundation, Calif, OpenAI and Wiz during the response, warned that the vulnerabilities could enable attackers to run unauthorized code, interrupt online services, and expose customer information. These risks made prompt patching essential for organizations that rely on affected PHP installations.

The PHP Foundation has issued patches and called on website operators to update their systems immediately. The National Security Agency also urged organizations using PHP to apply the updates or remove affected systems from the internet when they cannot be patched.

That urgency led some European government websites to become temporarily unavailable while their operators performed maintenance. Although short outages can be disruptive, taking a service offline during an emergency update may reduce the window in which a newly public vulnerability can be abused.

Years-old weaknesses became practical exploits

Researchers found the bugs in late August, but public disclosure waited until Wednesday, after PHP had prepared a fix. The underlying defects had existed for years. What changed was the ability to demonstrate a workable attack path through an unusually difficult sequence of technical steps.

“The underlying flaws had been present for decades, but demonstrating their exploitability required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve,” Wiz researchers wrote in a blog post. “Frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit.”

This distinction matters for website operators and security teams. A coding error may remain obscure for a long time if turning it into a reliable attack requires extensive experimentation, specialized knowledge, and substantial time. New AI capabilities can reduce those barriers, helping defenders uncover dangerous conditions more quickly but also increasing concern that malicious actors could pursue complex attacks more efficiently.

Wiz researchers used Google’s Gemini 4 Argon, Wiz Atlas, and OpenAI’s GPT-5.6 Sol during their work. The companies said AI enabled researchers to investigate cybersecurity issues across multiple applications in hours rather than following a far slower manual process.

“With frontier AI models and the right tools, a single researcher completed in a week what previously would have taken a world-class team months of work,” Wiz researchers wrote in a blog post on Wednesday.

A potential watershed for web security

Wiz compared PHP2Shell with Heartbleed, the major 2014 security bug involving encryption technology used by an estimated two-thirds of the web at the time. Heartbleed made it possible for criminals to retrieve information that should have remained protected, and it prompted a broad global effort to patch systems and replace exposed credentials.

The comparison reflects the potential significance of a flaw in a foundational piece of internet infrastructure. When software is embedded in millions of websites and services, a vulnerability can become a shared operational problem for public institutions, small businesses, hosting providers, and major online platforms alike. The immediate task is to patch affected software; the longer-term challenge is understanding how AI will alter the balance between discovering weaknesses and defending against them.

PHP2Shell also reinforces a basic security lesson for organizations: software updates are not merely routine maintenance. In situations involving remote code execution or potential memory disclosure, delayed patching can leave systems exposed to service disruption, unauthorized access, and possible data loss.

What website operators should consider

Organizations running PHP should identify their deployed versions, install the PHP Foundation’s security update, and verify that the patched environment is active across production systems. Teams that cannot update immediately should follow the NSA’s guidance to take affected services offline rather than leave vulnerable instances publicly accessible.

Operators should also treat patching as only one part of the response. A review of logs, access controls, credentials, backups, and internet-facing services can help determine whether unusual activity occurred before the update was applied. Sensitive credentials may need additional attention if there is any reason to suspect that system memory or application data was exposed.

The PHP2Shell disclosure arrives during an intensifying debate over the security implications of frontier AI. Policymakers and technology companies have warned that the same systems capable of accelerating defensive research may also lower the effort needed to develop sophisticated cyberattacks. In this case, AI helped bring a longstanding danger into view and supported the work needed to fix it. The speed of that discovery offers a clear benefit, while the exploit’s feasibility underscores why organizations must respond quickly when critical flaws become public.