Artificial intelligence just exposed two critical security holes in PHP, the programming language behind roughly 70 percent of the world’s websites. Government agencies and companies from France to Finland to the Netherlands took sites offline this week after the bugs leaked a day before the official fix.
PHP is the code that builds and runs a huge share of the internet you use every day. It handles the parts of a site that talk to the server — logins, forms, page generation, shopping carts. WordPress, many news outlets, online stores, and government portals all sit on top of it. The two flaws, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), let an attacker run commands on a vulnerable server from anywhere on the internet. No username. No password. Once inside, they can steal data, change what the site shows, or plant malware.
The internet is having a pretty insane 24 hours
AI helped discover critical vulnerabilities in PHP, which powers around 70% of websites
Right now there’s millions of hacking attempts reported by Cloudflare
Government websites taken offline as a precaution
Banks, airlines and other services disruptedDevelopers rushing to patch vulnerable systems
The crazy part is that AI is now helping both sides, finding vulnerabilities and helping hackers exploit them
— Penguin (@PenguinWeb3) October 22, 2026
Security firm Calif spotted one of the issues in August using OpenAI’s GPT-5.6 Sol model. The work was part of OpenAI’s Patch the Planet project, which uses AI to hunt bugs in open-source software. Google-owned Wiz found both flaws independently around the same time, drawing on its own tools plus Gemini 4 Argon and GPT-5.6 Sol. The problems had sat in PHP’s core engine for more than a decade, buried in how the language handles certain memory errors. PHP developers pushed emergency patches on Wednesday for the supported versions. The U.S. National Security Agency and FBI told operators to update immediately or take systems offline if they could not. Similar warnings came from Japan, European agencies, and others.
🇪🇺🇨🇦 UPDATE: Government websites across Europe and Canada went offline after reports that hackers were exploiting two serious flaws in PHP, a coding language that runs most of the web.
PHP powers about 75% of websites whose coding language is known. The flaws hid in it for years until AI helped find them, and they could let hackers take over sites.
Fixes are out, but updating millions of sites will take time. The Netherlands, Finland, France, and Canada took sites down as a precaution.
— NewsForce (@Newsforce) October 22, 2026
In practice, that meant sites went dark. French local government pages, including one for the Paris police, were pulled. Dutch services including the DigiD digital identity system, the House of Representatives site, and the national cybersecurity center went offline as a precaution. Finnish government pages, some UK city council sites, and support services for Wikipedia were among the others affected. A popular Pokémon sleep tracker app also went down for emergency work.
ChatGPT reports hundreds of websites have been taken down today but only list a handful. https://t.co/XdcVHIRChG
— Stephanie Starr (@StephanieStarrC) October 21, 2026
OpenAI called the discovery one of the most impactful vulnerabilities in recent memory and said it marks a new phase where AI can find security bugs with internet-scale reach. The company noted that the models located the holes before attackers did, giving defenders a window to prepare. Wiz added that AI also makes it easier to turn the bugs into working exploits that fit different server setups and PHP versions. A PHP Foundation security engineer compared the severity to the 2014 Heartbleed flaw.
Government and company websites around the world briefly went dark and suspended some services, as operators scrambled to patch their systems after artificial intelligence helped find critical vulnerabilities in a widely used programming language. https://t.co/7YWHhNOahM
— ABC7 News (@abc7newsbayarea) October 22, 2026
So far, public reports point mainly to scanning and early attack attempts rather than confirmed widespread break-ins. Large organizations can usually patch quickly. Smaller sites, older self-hosted blogs, and anyone running PHP on their own servers may stay exposed for days or weeks if they do not update. Only installations that serve web traffic are at risk; the fix is the only complete solution.
The same AI tools that found these flaws can be pointed at the internet by people who want to break things. Website operators now face a tighter clock. If you run a PHP site, check the version and update. If you do not know who hosts it, ask. For readers watching digital risks alongside other preparedness questions, Whatfinger News tracks related material on the Survival Command page.
Alex notes the practical side: AI found holes humans missed for more than ten years. Site owners now have to move faster than the people who want those holes.
— The Whatfinger News Team: Alex and Luke, with Grok on edits
Top Features and Vids across Whatfinger
- MAKE IT STOP: The Immigration Grift Is Turning America Into Something Else
- Same Impossible Clues on Every Continent: What the Stones Still Refuse to Explain on A Past Massive Civilization
- Warning to all parents for Halloween: 60f popular candies laced with poison. Candies named
- For Three Buffetts, a $150 Billion Puzzle Over Warren’s Riches: Warren Buffett’s three kids now face a $150 billion job: give the money away before it grows any larger.
- Democrat Medicare and Medicaid Fraud is in the Tens of billions a year
- ‘You Are a Sick Person!’: Trump SCOLDS Multiple Reporters as They Talk Over One Another (Many clips linked)
- The Jalen Hurts Situation Is INSANE! | Eagles UNDER FIRE As Jalen Hurts Is Out For The SEASON
<span class="dsq-postid" data-dsqidentifier="162426 https://dedicatedissues.com/?p=162426">1 Comment
Pingback: Morgan Stanley, Bank of America, JPMorgan, and Wells Fargo detect unauthorized AI agents accessing customer accounts – Dedicated Issues of Whatfinger News