Two critical security vulnerabilities discovered in PHP, a widely used web scripting language, have prompted a global response involving website outages and urgent software updates. The flaws, identified independently by multiple security firms with assistance from artificial intelligence (AI) tools, pose significant risks by allowing unauthenticated attackers to execute arbitrary code and potentially access sensitive server data.

PHP underpins an estimated 70% of websites worldwide and forms the foundation of popular content management systems and platforms such as WordPress, Drupal, Magento, Joomla, and Laravel. The vulnerabilities, collectively referred to by researchers as PHP2Shell, are located in core memory management and error-handling components of PHP. Exploitation could grant attackers control over web servers, enabling them to read confidential data like passwords, API keys, and authentication tokens, or gain access to databases and file systems without needing a login.

The discovery of these flaws triggered widespread precautionary measures. Government services and private companies across multiple countries temporarily took websites offline to mitigate risk ahead of patches becoming available. Notable outages occurred in the Netherlands—with DigiD, the national digital identity service, and the Dutch House of Representatives websites taken down—as well as in France, where Paris police’s online portals were disabled following guidance from national cybersecurity authorities. Australia’s cyber.gov.au platform and several entertainment-related services, including multiple Pokémon apps and the Japanese game Umamusume, also underwent emergency maintenance or shutdowns.

The US National Security Agency (NSA) issued an advisory urging organisations to patch or disconnect vulnerable systems immediately. Similarly, the PHP Foundation, which supports the language’s development, described the incident as the most severe security issue PHP has faced in over a decade, comparing it to the 2014 Heartbleed flaw that necessitated a global patching rush. Emergency fixes have been released in various PHP versions, but concerns remain due to the vast number of older installations that may lack support or the technical capacity for rapid updates. Estimates suggest more than 22 million servers could be exposed.

The vulnerabilities were first detected in August through an AI-driven code audit funded by OpenAI, using models such as GPT-5.6 Sol. Security company Wiz, owned by Google, confirmed the findings independently with help from AI tools including Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol. OpenAI acknowledged the flaws as a watershed moment for AI-assisted cybersecurity, indicating an accelerating trend in vulnerability discovery aided by machine learning technologies.

Originally, details about the flaws had been embargoed while developers prepared patches, but an unexpected leak on the eve of the fix’s official release forced a rapid, global response. This leak included “proof-of-concept” exploit code widely circulated online, raising the risk of imminent attacks. While some agencies reported no active exploitation at the time of their alerts, others confirmed ongoing attacks, reflecting the rapidly evolving threat environment.

For website owners and administrators, the consensus from cybersecurity experts and government bodies is clear: immediate updates to PHP are critical to prevent potentially devastating breaches. Meanwhile, users are advised to practice enhanced security measures such as using strong, unique passwords and enabling two-factor authentication when available, since the vulnerabilities make it easier for attackers to bypass traditional login protections.

This incident underscores the increasingly intertwined role of AI in both discovering and exacerbating cybersecurity challenges, while highlighting the ongoing need for vigilance across digital infrastructure that a vast proportion of the internet relies upon.