Websites shut down globally after AI finds flaw affecting 70% of the internet

Governments and companies around the world are racing to fix security weaknesses found with the help of artificial intelligence (AI). These weaknesses could affect 70% of the world's websites.

Some websites and online services briefly stopped working after the weaknesses were announced on Wednesday.

The US National Security Agency and Europe's cybersecurity agency told companies to act immediately to fix two serious security flaws in PHP, a programming language used by 70% of the world's websites.

The flaws in PHP were found and addressed by teams at OpenAI, Google-owned cybersecurity company Wiz, and another cybersecurity company called Calif. The weaknesses had existed for a decade, but taking advantage of them required a complicated series of steps that were at the edge of what human researchers could realistically manage, according to Wiz. Researchers then used AI to adapt methods for exploiting the weaknesses and study the results. In cybersecurity, these methods are known as exploits.

The bugs, together called PHP2Shell, could let attackers break into websites and read computer memory that might contain private information, such as passwords.

The PHP Foundation, the organization responsible for the programming language, has released a fix for the bugs, which had remained hidden in its software for years. It is urging website operators to update their systems right away. The CEO of Cloudflare said on X that his company's network had detected millions of attempts to exploit the weaknesses over the past few days.

“Because PHP is used by such a large part of the web, the risk could reach almost everywhere people spend money online,” said Nigel Green, CEO of deVere Group, a financial advice company.

“Booking platforms, online marketplaces, subscription services, ticket-selling websites, delivery apps and utility websites could all store payment card details on systems built with similar code,” he added.

‘AI inflection point’

The weaknesses involve how the PHP programming language handles computer memory. If a website request ends unexpectedly, PHP may leave data behind in memory. That data could later be accessed, changed or exposed.

The bugs were found in late August but were not made public until Wednesday, after PHP developers had prepared a fix.

According to Wiz, AI played a key role in finding and fixing weaknesses that had remained hidden in PHP's code for more than a decade. The company called PHP the “backbone of the web” and said the discovery marked a major turning point for AI.

“What AI changed was the ability to understand the weaknesses,” Wiz researchers wrote in a blog post on Wednesday. AI then helped them quickly turn those weaknesses into a way to attack systems.

“With the most advanced AI models and the right tools, one researcher completed in a week what would previously have taken a world-class team months of work,” they added.

According to web infrastructure company Cloudflare, the flaws could let attackers run code on remote computers, interrupt services and expose customer data. Cloudflare has been working with the PHP Foundation, Calif and OpenAI and Wiz to address the problem.

During their research, the Wiz team used Google's Gemini 4 Argon, Wiz Atlas and OpenAI's GPT-5.6 Sol.

World leaders weigh in

World leaders urged organizations to take action. Dutch Prime Minister Rob Jetten said his cabinet was “closely monitoring the situation surrounding the vulnerabilities in PHP.”

Japan's Prime Minister Sanae Takaichi said companies should consider temporarily stopping services if needed to reduce their risk. “Please check if your publicly available websites use PHP, and prepare to apply the fix patch that will be released tonight… as soon as possible,” she posted on X on Wednesday.

Japanese airline ANA, railway operator JR West and the country's largest bank, MUFG, were among the companies that reported temporarily suspending some webpages and services.

In Europe, government websites in France, Denmark, Finland and the Netherlands were temporarily taken offline while security fixes were installed. These included the Dutch cybersecurity agency's website.

The Wikimedia Foundation, the nonprofit organization that runs Wikipedia, told CNN on Thursday that it was “in the process of addressing security vulnerabilities in PHP.” It said some of its systems had been taken offline as a “precautionary measure.”

Nearly three dozen UK government services are unavailable, and four others are “partially unavailable,” while security upgrades are being carried out, UK government minister Elizabeth Lloyd told the House of Lords on Thursday. The Journal, Ireland's second-most popular news outlet, was also temporarily offline on Thursday morning while it strengthened its “defences,” according to a notice from the publication.

A shift in cybersecurity

Wiz researchers say the problem is comparable to the Heartbleed bug discovered in 2014. Heartbleed affected an encryption technology believed to be used by about two-thirds of the web. It allowed cybercriminals to access information that should have been protected.

Wiz researchers say PHP2Shell could be a similar turning point for cybersecurity. Although the weaknesses had existed for years, AI made it practical to use them in attacks.

“The underlying flaws had been present for decades, but showing that they could be exploited required an extremely complicated series of steps, at the edge of what human researchers could realistically achieve,” the researchers said.

“The most advanced AI models greatly lowered that barrier, turning a long-existing flaw into a working exploit.”

The-CNN-Wire™ & © 2026 Cable News Network, Inc., a Warner Bros. Discovery Company. All rights reserved.