Artificial intelligence has helped expose two serious security flaws in PHP, the programming language powering much of the internet, prompting organisations across Europe to take websites and digital services offline while they worked to prevent potential attacks.
The vulnerabilities had remained undetected for more than a decade. Advanced AI systems from OpenAI and Google helped turn a suspected weakness into a working exploit, highlighting how quickly AI could accelerate cyber threats.
Follow THE FUTURE on LinkedIn, Facebook, Instagram, X and Telegram
Europe Moves To Contain The Risk
The Netherlands took down its DigiD digital identity system, the Overheid.nl government portal and the website of the lower house of parliament. The Port of Rotterdam, hospitals, the country’s five largest political parties and even the Dutch National Cyber Security Centre also took websites offline.
Elsewhere, Finland’s state IT provider Valtori suspended government web services, France’s Interior Ministry placed local administration websites into maintenance mode, and Germany’s federal IT service, ITZBund, took several portals offline.
CERT-EU advised organisations unable to patch immediately to take affected websites offline. The European Commission, ENISA, CERT-EU, Europol and national cyber response teams subsequently urged organisations to act without delay, particularly on internet-facing systems.
Why PHP Matters So Much
Created in the early 1990s, PHP remains one of the web’s most widely used programming languages. Security firm Wiz Research estimates that it runs behind roughly seven in 10 websites, including platforms such as WordPress, Drupal and Joomla.
PHP handles essential functions such as logins, payment processing and content delivery, making vulnerabilities in its code a potential global risk. According to Wiz, every PHP version released over the past decade is affected by at least one of the flaws.
A fix was released on Wednesday. The PHP Foundation urged teams to update immediately to patched versions PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Older versions no longer receive official support and should be considered exposed unless vendors have backported the fix, CERT-EU warned.
Websites and applications, from the Paris police website to a Pokémon sleep tracker, temporarily went offline as developers secured their systems.
How AI Turned A Theory Into A Working Attack
The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 and rated 9.2 out of 10 in severity, affect PHP’s memory management and error handling. Under specific conditions, an attacker could exploit a memory-limit issue to execute malicious code remotely without logging in.
The PHP Foundation said developers first identified signs of the problem during an external audit in 2024. Although researchers developed a theoretical exploit, progress towards a practical attack path and a fix repeatedly stalled as the small core team weighed the risks. The foundation later called the delay “a structural failure”.
In August, security firm Calif, working on an OpenAI-funded audit of PHP’s source code and using OpenAI’s GPT-5.6 Sol model, reported a working remote attack. OpenAI independently identified the issue that day. Two weeks later, Wiz developed additional attack paths using its Wiz Atlas tool alongside Google’s Gemini 4 Argon and GPT-5.6 Sol.
“With frontier AI models and the right tools, a single researcher completed in a week what previously would have taken a world-class team months of work,” Wiz researchers wrote.
OpenAI called the discovery “one of the most impactful vulnerabilities in recent memory”, saying AI could now identify security flaws with “internet-scale impact”.
The findings were kept confidential while a fix was prepared. However, the two CVE identifiers appeared on online forums and social media on Tuesday afternoon. PHP brought forward its release by a day, while Calif mistakenly published and then deleted a video demonstrating its proof of concept against multiple targets. Copies quickly spread, according to the PHP Foundation.
“The moment all the information’s out there, people can weaponise it very, very quickly,” Steve Kerrison, a senior lecturer in cybersecurity at the Singapore campus of James Cook University, told AFP.
Has Anyone Been Hacked Yet?
Taking a website offline does not necessarily mean it has been compromised. Dimitrios Salampasis of Australia’s Swinburne University of Technology said shutdowns can be a responsible precaution while patches are applied.
The PHP Foundation said its security team reviewed the proof-of-concept code circulating after the leak and found no functional exploit at the time of release.
However, Cloudflare reported attack traffic targeting its customers on Wednesday, while CERT-EU warned that the public availability of technical details could encourage attackers to probe vulnerable systems.
Large organisations may patch quickly, but smaller operators could remain exposed for weeks or months. Personal blogs and small business websites could be hijacked to distribute malware, send spam or host malicious content.
The Bigger Risk Goes Beyond The Patch
Even after systems are updated, stolen data could be used in phishing attacks to obtain passwords, payment details and other sensitive information.
Third-party dependencies add another risk: websites may remain exposed if the providers they rely on fail to patch their own systems. “Even though you patched yourself … you’re still unsecure,” said Rahat Masood, a senior lecturer in cybersecurity at the University of New South Wales in Sydney.
The incident also raises questions about the resources behind PHP’s security. The language supports government services, banks and online retailers worldwide, yet its security depends heavily on a relatively small group of foundation-funded developers and volunteers.
AI can identify and demonstrate vulnerabilities faster than ever, but fixing them without disrupting the systems that depend on them still requires experienced engineers and a more resilient approach to software security.
