AI uncovers critical PHP flaws, prompting worldwide website shutdowns

Artificial-intelligence models spotted two high-severity remote-code execution flaws in PHP, the scripting language behind the majority of internet sites. The vulnerabilities, described as among the most serious ever found in PHP, triggered urgent warnings from the US National Security Agency, Japan, the European Union and a Chinese ministry, all recommending immediate patching or temporary shutdowns. Governments and firms worldwide, from Australia to Finland, took sites offline while the PHP Foundation released a patch on Wednesday.

Security scholars said the bugs could let attackers infiltrate servers without usernames or passwords, enabling data theft or content manipulation. The flaws were initially found by the security firm Calif using OpenAI's GPT-5.6 Sol and later. Although no large-scale attacks have been reported yet, experts caution that unpatched sites remain at risk for future exploitation.