Websites go dark after AI exposes major programming language security flaw

By Harry Bligh Published on 22/10/2026 - 10:47 GMT+2 Share Comments Add Euronews on Google Share Facebook Twitter Flipboard Send Reddit Linkedin Messenger Telegram VK Bluesky Threads Whatsapp Government agencies and companies around the world shut down websites Wednesday after two critical flaws came to light involving PHP, a programming language that is the basis for a large share of the internet. Critical security flaws have been discovered in PHP, a widely used programming language that helps power around 70% of the world’s websites. ADVERTISEMENT ADVERTISEMENT Developers released emergency fixes on Wednesday, while cybersecurity authorities urged organisations to update affected systems immediately or take them offline until they could be secured. The US National Security Agency warned websites to go offline until a fix is found The warning prompted governments, companies and major online services in several countries to temporarily shut down websites and other systems as a precaution. The vulnerabilities were uncovered with the help of artificial intelligence. Security firm Calif identified one of the flaws in August during an OpenAI-funded audit of PHP, while Google-owned cybersecurity company Wiz independently discovered and reported both vulnerabilities. OpenAI said its GPT-5.6 Sol model was used in the Calif research. The PHP security team rated both vulnerabilities 9.2 out of 10 for severity. Details were meant to remain confidential while developers prepared fixes, but information about the flaws emerged publicly before the planned release, intensifying the race to secure vulnerable systems. Security researchers initially reported little evidence of widespread exploitation before the vulnerabilities became public. However, attempted attacks have since been detected, increasing concern that unpatched systems could be targeted. Websites and services taken offline The Wikimedia Foundation, which operates Wikipedia, said it deliberately took a number of supporting services offline while security updates were installed and warned users that some disruption could occur. Amazon Threat Intelligence also detected attempts to exploit the vulnerabilities, including activity before their public disclosure. Security researchers have since reported attempts to target vulnerable systems in the wild. Several European governments have also taken precautionary action. France’s Interior Ministry temporarily took prefecture websites offline while updates were applied, while Germany’s federal IT provider ITZBund shut down several government websites. German officials said the move was precautionary and that no security incidents had been identified. Government and public-service websites were also taken offline in countries including the Netherlands and Finland, as authorities worked to secure their systems. In the UK, the National Cyber Security Centre urged organisations running PHP to identify vulnerable systems, monitor them for suspicious activity and install security updates as soon as possible. Go to accessibility shortcuts Share Comments Add Euronews on Google Read more Thousands of supermarket fridges still exposed after cyberattack Hackers access data of 8.8 million people in Denmark in 'extremely serious' breach Rogue AI agents tried and failed to hack US and Canadian government websites World News Daily news news Comments