AI-found PHP flaws trigger emergency shutdowns across Europe

Websites were taken offline across Europe after AI-assisted research uncovered PHP vulnerabilities that could let attackers seize remote servers, exposing the accelerating race between disclosure and exploitation.

Government and security teams across Europe moved quickly to take websites offline on Wednesday after two serious flaws were identified in PHP, the scripting language that powers a large share of the modern web. The precautionary shutdowns affected public-sector and community sites in countries including Finland, the UK, Germany, Denmark, the Netherlands and Belgium, reflecting the speed with which a software weakness can ripple through the internet when it sits inside a widely used foundation.

According to the PHP Foundation, the defects were disclosed the same day and fixes were released alongside guidance for administrators. Security specialists warned that the weaknesses could allow attackers to run code on remote servers, potentially giving them control of affected systems without needing valid credentials. The reach of the problem is significant: Palo Alto Networks said about 22 million platforms were exposed, while other estimates put PHP behind roughly 70% of known websites.

What made the incident especially notable was the role of artificial intelligence in finding the flaws. OpenAI said the issues were discovered by the security company Calif using one of its latest models, and the company described the vulnerabilities as among the most consequential security problems seen in recent memory. Wiz, the Google-owned cybersecurity company, also identified the same weaknesses. OpenAI said the episode showed both the promise and the danger of increasingly capable AI tools: they can uncover hidden defects in software, but they may also help hackers accelerate attacks.

The episode has intensified debate over how quickly defenders can respond once a flaw is exposed. Axios reported that exploitation attempts began almost immediately after disclosure, underscoring how little time system operators may have to patch critical infrastructure. The Associated Press reported that the FBI’s cyber division urged immediate updates or temporary shutdowns for unpatched systems, while the PHP Foundation issued fixes and security advice. In practice, that meant some operators judged it safer to disconnect services altogether until patches could be applied.

The latest warning also came against the backdrop of a separate alert a day earlier about a flaw in TLS, the protocol that helps secure internet communications. Matthew Prince, the head of Cloudflare, said on X that two extremely serious vulnerabilities had emerged within 24 hours, one affecting everyone online and the other affecting nearly anyone running a server. For security teams already strained by a fast-moving threat landscape, the PHP incident has become a stark example of how AI is reshaping both the discovery of vulnerabilities and the pace at which the internet must defend itself.

Source Reference Map

Inspired by headline at: ^[1]

Sources by paragraph:

Source: Fuse Wire Services