Some websites shut down globally as operators address PHP issue after AI finds critical flaw
Government and company websites around the world briefly went offline, and some services were paused, as operators rushed to fix their systems. They took these steps after artificial intelligence helped find serious security weaknesses in PHP, a widely used programming language.
The discovery comes as advances in AI have raised concerns in Washington and Silicon Valley that the technology could make cyberattacks much more powerful.
The US National Security Agency and Europe's cybersecurity agency on Wednesday urged companies to act quickly to fix two serious security flaws in PHP. PHP is a programming language used by 70% of websites worldwide, including sites built with WordPress and Drupal, an open-source system for managing website content.
The PHP Foundation, the organization responsible for the programming language, has released a fix for the bugs. The weaknesses had remained hidden in the software for years. The foundation is urging website operators to update their systems right away.
The Journal, a popular Irish news website, was temporarily offline on Thursday morning while it strengthened its security, according to a notice on the site. The Journal is Ireland's second-most-used online news source, behind only RTÉ, the national broadcaster, according to the Reuters Institute.
Teams at OpenAI, Wiz, a cybersecurity company owned by Google, and another cybersecurity company called Calif discovered the flaws in PHP. The name PHP originally stood for Personal Home Page. Together, the bugs are called PHP2Shell. They could let attackers break into websites and read computer memory that might contain private information, such as passwords.
World leaders weigh in
World leaders also urged organizations to take action. Dutch Prime Minister Rob Jetten said his cabinet was closely watching the situation involving the security flaws in PHP.
Japan's Prime Minister Sanae Takaichi said companies should consider temporarily stopping services if needed to reduce their risk. On Wednesday, she posted on X: "Please check if your publicly available websites use PHP, and prepare to apply the fix patch that will be released tonight... as soon as possible,"
Japanese airline ANA, railway operator JR West and the country's largest bank, MUFG, were among the companies that reported temporarily suspending some webpages and services.
In Europe, government websites in France, Denmark, Finland and the Netherlands were temporarily taken offline while security fixes were put in place. These included the Dutch cybersecurity agency's website.
The Wikimedia Foundation, the nonprofit organization that runs Wikipedia, told CNN on Thursday that it was working to fix security weaknesses in PHP. It said some of its systems had been taken offline as a precaution.
'AI inflection point'
AI played a key role in finding and fixing security weaknesses that had remained hidden in PHP's code for more than a decade, according to Wiz. The company said the event marks an "AI inflection point," meaning a major change in how AI affects cybersecurity.
"What AI changed was the ability to understand the weaknesses and turn them into a working exploit," Wiz researchers wrote in a blog post on Wednesday. They added that, with advanced AI models and the right tools, one researcher completed in a week work that would previously have taken a world-class team months.
The bugs were discovered in late August, but the public was not told about them until Wednesday, after PHP had prepared a fix.
According to internet infrastructure company Cloudflare, the flaws could let attackers run code on remote computers, disrupt services and expose customer data. Cloudflare has been working with the PHP Foundation, Calif, OpenAI and Wiz to address the problem.
During their research, Wiz researchers used Google's Gemini 4 Argon, Wiz Atlas and OpenAI's GPT-5.6 Sol.
Heartbleed similarities
Wiz researchers said the issue is as serious as the Heartbleed bug discovered in 2014. Heartbleed affected an encryption technology estimated to be used by two-thirds of the Web. It allowed cybercriminals to access information that should have been protected.
Wiz researchers said PHP2Shell could, like Heartbleed, become a major turning point in cybersecurity. The weaknesses had existed for years, but AI made it practical to use them in attacks.
"The underlying flaws had been present for decades, but demonstrating their exploitability required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve," the researchers said.
"Frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit."
- John Liu, Anna Cooban and Amy Croffey contributed reporting.
The-CNN-Wire™ & © 2026 Cable News Network, Inc., a Warner Bros. Discovery Company. All rights reserved.