What is the PHP security scare? How OpenAI, Google and Amazon raced to contain it

• Two serious security flaws in PHP have led governments to take some websites offline.
• Amazon detected a suspected attempt to exploit the flaws four days before PHP released fixes.
• Cloudflare reported millions of attempts to exploit the flaws as website operators rushed to install updates.

A major security scare involving PHP, software used by much of the internet, has forced government agencies and businesses to take some websites offline while they work to fix two serious security flaws.

Japanese Prime Minister Sanae Takaichi urged website operators to install emergency security updates or consider temporarily shutting down services that were at risk.

The flaws could let attackers run harmful commands on vulnerable servers without signing in. Artificial intelligence (AI) helped researchers find the flaws, but Amazon says it detected a suspected attack attempt four days before the fixes became public.

The incident shows how quickly a hidden weakness in software can become a worldwide security problem.

PHP security scare: Why governments took websites offline

PHP is software that runs behind the scenes of websites. It handles requests and works with applications and databases. It is used by about 70% of websites whose server-side programming language is known.

The two flaws, CVE-2026-109618 and CVE-2026-109619, each have a critical severity score of 9.2 out of 10. Under certain conditions, attackers can take advantage of weaknesses in how PHP manages computer memory and gain control of servers without needing a password.

Finland, the Netherlands and France temporarily limited access to government services. The Wikimedia Foundation also shut down some systems, while Japanese financial group Mitsubishi UFJ stopped selected online services.

These shutdowns were safety measures. They do not mean the organisations were successfully hacked. Japanese officials said that no related damage had been reported when they made their statement.

Alan Woodward, a cybersecurity professor at the University of Surrey, warned in The Guardian: “There is this race and some people unfortunately don’t even know they are in the race.”

He said websites that are not properly maintained could remain at risk for months, even after larger organisations install the fixes.

How AI uncovered a threat hidden for years

Security researchers used AI tools to find weaknesses hidden in PHP's internal workings for more than a decade.

OpenAI said a researcher named Calif found one flaw using GPT-5.6 Sol. Wiz, which is owned by Google, independently found and reported both flaws using several tools, including Google's Gemini 4 Argon.

The flaws involve how PHP manages computer memory while handling website requests. If attackers exploit them successfully, they could run their own code or steal sensitive information. This could put databases and customer records at risk.

However, the AI companies did not fix PHP themselves. The PHP maintainers led the work to fix the problems and released emergency security updates on 21 October, with help from researchers and companies that provide internet infrastructure.

Raghu Nandakumara, an executive at cybersecurity company Illumio, told Associated Press: “Speed without control creates a new kind of security problem.”

AI can help researchers find dangerous software bugs faster. But it can also help attackers study newly released fixes and look for ways to exploit systems before organisations install the updates.

Amazon's early warning shows danger remains

Amazon's threat intelligence team said its MadPot network of decoy systems detected an attempt to exploit the PHP flaws on 17 October, four days before the flaws were publicly announced.

The activity came from an internet address that had been anonymised. However, Amazon could not work out how the suspected attacker had learned about the flaws. Amazon did not report that any of its customers had been hacked.

After the flaws were made public, Cloudflare detected millions of attempts to exploit them across its network. These attempts do not mean that the attacks succeeded.

“We are seeing early attacks emerging and are updating mitigations as new vectors show up,” Cloudflare technology chief Dane Knecht said, according to ABC News.

PHP developers released fixes in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Users of older versions that are no longer supported need to upgrade or install suitable fixes provided by their software vendors.

Firewalls can help protect systems for a short time, but they do not replace the need to install security updates.

AI helped researchers uncover a danger that had existed for years. Whether it turns into a long-lasting security crisis now depends on how quickly website operators install the fixes.