PHP security flaws trigger worldwide site outages: what six AIs agree on, and what they added or left out

Thesis

Critical PHP vulnerabilities discovered via AI prompted worldwide website shutdowns and emergency patching across government and corporate sectors.

Claims (10)

1. Two critical vulnerabilities in PHP programming language were identified and publicly disclosed.CNBC“Developers of the PHP programming language said Tuesday they had identified two critical vulnerabilities”
2. PHP powers approximately 70-75% of websites whose programming language can be identified.France 24“PHP code helps run about 70 percent of the world's websites”
3. Artificial intelligence models were used to discover the PHP vulnerabilities.Al Jazeera“Cybersecurity experts discovered the pair of vulnerabilities, dubbed PHP2Shell, with the help of artificial intelligence (AI) models.”
4. A PHP security fix was released on Wednesday at approximately 1345 GMT.CNBC“They said around 1345 GMT on Wednesday that a new version fixing the vulnerabilities was live.”
5. Government websites in multiple European countries went offline as a precautionary measure.CNBC“government agencies in the Netherlands and Finland were among those that took sites offline ahead of the fix as a precaution.”
6. Hackers were actively exploiting the vulnerabilities before the fix was released.CNBC“with reports that hackers were exploiting the flaws to break into websites”
7. Cloudflare observed millions of exploitation attempts following public disclosure of the vulnerabilities.France 24“Cloud services firm Cloudflare saw millions of exploitation attempts after the public disclosure of PHP's critical vulnerabilities”
8. Security firm Calif discovered vulnerabilities using OpenAI's GPT-5.6 Sol model in August.France 24“Security firm Calif found the flaws in August using OpenAI's GPT-5.6 Sol model.”
9. Wiz security firm independently discovered vulnerabilities weeks after Calif using AI models including Google's Gemini 4 Argon.France 24“Wiz, which is owned by Google, said it found them independently weeks later with help from AI models including Google's Gemini 4 Argon”
10. The vulnerabilities allowed attackers to execute remote commands without authentication on vulnerable PHP servers.Al Jazeera“an attacker can remotely run commands on a server running old PHP code over the internet, without needing a password or legitimate account access.”

Left open

• Which specific PHP versions are vulnerable - SOURCE 1 states officials said versions 5 onward could be affected but PHP had not disclosed which versions are actually vulnerable
• The exact timeline of when details leaked online - SOURCE 2 states details leaked Tuesday, a day before the planned fix release, but SOURCE 1 does not mention this leak
• Whether Calif and Wiz discovered the same vulnerabilities or different ones - SOURCE 2 suggests they were independent discoveries while SOURCE 3 implies they are the same pair of vulnerabilities

Stakes

Billions of websites and critical infrastructure rely on PHP. The vulnerabilities could enable attackers to compromise servers at scale without authentication. AI-accelerated exploitation threatens millions of systems, particularly small websites lacking technical resources. Extended patching windows leave prolonged exposure for shared hosting customers.

What this model would watch

• Adoption rate of PHP patches across website operators, particularly small and shared hosting sites
• Number and sophistication of active exploitation attempts as attackers weaponize the vulnerabilities
• Timeline for restoring government and corporate websites taken offline as precaution
• Whether AI-discovered vulnerabilities accelerate the pace of future security flaws in other widely-used software

Thesis

Critical vulnerabilities in PHP led to widespread website shutdowns as organizations rushed to secure their systems against potential attacks.

Claims (8)

1. A significant number of websites, including government sites, were taken offline globally as a precaution against vulnerabilities in PHP.CNBC“government websites in Europe and elsewhere went offline”
2. Cybersecurity firms used AI to uncover two critical vulnerabilities in PHP, affecting about 70% of the world's websites.France 24“the flaws rank among the most severe vulnerabilities discovered in PHP”
3. The vulnerabilities allow attackers to run commands on servers running vulnerable PHP code remotely, without authorization.Al Jazeera“mean an attacker can remotely run commands on a server running old PHP code”
4. PHP programmers released a patch to fix the vulnerabilities on Wednesday, following their discovery earlier this year.France 24“PHP programmers on Wednesday released a patch fixing the vulnerability”
5. Cybersecurity experts emphasized the risks posed by AI-assisted hacking, leading to increased attack attempts post-announcement.France 24“Cloudflare saw millions of exploitation attempts after the public disclosure”
6. The NSA urged organizations using PHP to update immediately or take vulnerable sites offline.Al Jazeera“the United States National Security Agency (NSA) advised taking websites offline”
7. Shutdowns affected various sectors, including government, transport, and media, highlighting widespread disruption due to PHP vulnerabilities.CNBC“several organizations followed the example of the National Cyber Security Center and took public-facing websites offline”
8. The vulnerabilities were discovered with the aid of AI models, marking a new phase in vulnerability detection.Al Jazeera“AI tools let researchers find vulnerabilities in software by testing more attacks than human programmers can alone”

Left open

• There is some discrepancy in the percentage of websites affected, as one source cites 70% and another mentions 75%.
• It is unclear how many specific websites in different countries were affected during this event.

Stakes

This incident raises significant concerns about the security of a major portion of the internet, highlighting vulnerabilities that could lead to widespread cyberattacks, disrupting services globally.

What this model would watch

• The response from tech companies regarding the patch deployment and security measures.
• Potential rise in cyberattacks utilizing these vulnerabilities before patches are universally applied.
• Further developments from AI-assisted vulnerability discoveries and subsequent impacts on cybersecurity practices.

Thesis

Critical security vulnerabilities in the widely used PHP programming language, uncovered by artificial intelligence, prompted mass website outages and emergency patches globally as governments and corporations rushed to prevent cyberattacks.

Claims (8)

1. Critical vulnerabilities in the PHP programming language were discovered with the help of artificial intelligence.Al Jazeera“AI was used to pinpoint two vulnerabilities in the PHP language”
2. PHP programmers released a patch fixing the vulnerability on Wednesday.France 24“PHP programmers on Wednesday released a patch fixing the vulnerability.”
3. Government agencies and companies around the world shut down websites as a precaution ahead of or during the fix.CNBC“government agencies in the Netherlands and Finland were among those that took sites offline ahead of the fix as a precaution.”
4. The United States National Security Agency advised organizations to patch their sites immediately or pull vulnerable systems offline.France 24“the US National Security Agency told organisations to patch their sites immediately or pull vulnerable systems offline.”
5. Security firm Calif found the flaws using OpenAI's GPT-5.6 Sol model as part of an audit.France 24“Security firm Calif found the flaws in August using OpenAI’s GPT-5.6 Sol model.”
6. Wiz found the second vulnerability independently weeks later with help from AI models.France 24“Wiz, which is owned by Google, said it found them independently weeks later with help from AI models”
7. Cloudflare saw exploitation attempts jump to millions following the public disclosure.France 24“That jumped to tens of thousands ​to exploit it. That jumped to tens of thousands ​in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now”
8. The vulnerabilities could allow attackers to run commands on servers without a username or password.France 24“attackers to get into your servers without any authorisation, without any username or password”

Left open

• The exact percentage of global websites run by PHP, with sources varying between about 70 percent and roughly 75 percent.
• The precise timeline of when details leaked online versus when public disclosures officially occurred.

Stakes

The discoveries highlight a dangerous new phase where AI accelerates the discovery of severe software vulnerabilities, threatening internet-scale infrastructure and forcing a massive, urgent global patching effort across governments, corporations, and public services.

What this model would watch

• The speed and extent of global patch adoption by small websites and shared hosting providers.
• Further statements or metrics from cloud security firms regarding ongoing exploit attempts.
• Additional security disclosures or policy responses driven by AI-assisted vulnerability findings.

Thesis

Critical PHP vulnerabilities discovered via AI led to global website outages as governments and corporations rushed to patch systems.

Claims (8)

1. AI tools discovered two critical vulnerabilities in PHP, a widely used programming language.France 24“Security firm Calif found the flaws in August using OpenAI’s GPT-5.6 Sol model.”
2. PHP vulnerabilities affect roughly 70% of websites worldwide.France 24“Wiz estimated that PHP code helps run about 70 percent of the world's websites.”
3. Government websites in multiple countries went offline as a precaution.CNBC“Government agencies in the Netherlands and Finland were among those that took sites offline.”
4. The NSA advised organizations to patch PHP immediately or take systems offline.Al Jazeera“Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update.”
5. Cloudflare reported millions of exploitation attempts following the vulnerability disclosure.France 24“Cloudflare saw millions of exploitation attempts after the public disclosure.”
6. The vulnerabilities allow remote code execution without authentication.Al Jazeera“An attacker can remotely run commands on a server running old PHP code over the internet, without needing a password.”
7. AI-assisted discovery of vulnerabilities is accelerating cybersecurity risks.France 24“Increasingly powerful AI models can spot weak points in computer scripts that have gone unnoticed by humans.”
8. The PHP Foundation called the flaws among the most severe in PHP's history.Al Jazeera“The group said the flaws were among the most severe it had encountered.”

Left open

• Which specific PHP versions are affected by the vulnerabilities.
• The exact number of websites or services that remain unpatched.
• Whether the vulnerabilities were exploited before the patch was released.
• The full extent of data breaches or unauthorized access resulting from the flaws.

Stakes

The vulnerabilities pose a massive risk to global cybersecurity, potentially exposing millions of servers to remote attacks. AI-driven discovery of such flaws could lead to more frequent and severe cyber threats, requiring urgent and coordinated responses from governments and corporations.

What this model would watch

• The rate of PHP patch adoption across different sectors and regions.
• Reports of successful exploits or data breaches linked to the vulnerabilities.
• Government and corporate responses to future AI-discovered vulnerabilities.
• The impact of AI tools on both offensive and defensive cybersecurity strategies.

Thesis

AI-assisted discovery of two critical PHP vulnerabilities triggered precautionary website shutdowns worldwide before a patch became available, exposing the difficulty of rapidly securing internet-scale infrastructure.

Claims (8)

1. PHP developers released a fix for two critical vulnerabilities on Wednesday.CNBC“a new version fixing the vulnerabilities was live”
2. Government agencies in the Netherlands and Finland took websites offline as a precaution.CNBC“government agencies in the Netherlands and Finland were among those that took sites offline”
3. The vulnerabilities could allow attackers to remotely execute commands without authentication.Al Jazeera“an attacker can remotely run commands on a server running old PHP code over the internet”
4. The flaws were discovered with assistance from artificial-intelligence models.Al Jazeera“Cybersecurity experts discovered the pair of vulnerabilities, dubbed PHP2Shell, with the help of artificial intelligence (AI) models.”
5. The NSA advised organizations to update PHP immediately or take vulnerable systems offline.France 24“the US National Security Agency told organisations to patch their sites immediately or pull vulnerable systems offline”
6. Cloudflare reported that exploitation attempts increased from thousands to millions after public disclosure.France 24“That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now”
7. France temporarily made local-government administrative websites inaccessible while addressing the vulnerabilities.CNBC“France's Interior Ministry said it had temporarily taken local government administrative websites offline”
8. The reports differ on PHP’s affected scope, with one saying all versions from PHP 5 onward could be affected and another limiting exposure to self-hosted PHP systems.CNBC“all PHP versions from 5 onward could be affected”

Left open

• The reports do not identify the exact vulnerable PHP versions.
• They do not establish how many websites were successfully compromised, rather than merely targeted.
• They differ on the estimated share of websites using PHP, citing roughly 70 percent versus roughly 75 percent of identifiable-language sites.
• They do not specify when every temporarily disabled website returned to service.
• The reports do not fully reconcile the discovery timeline, including the roles of Calif, Wiz, OpenAI, and other AI models.

Stakes

Unpatched PHP servers could permit unauthenticated remote command execution, potentially enabling theft, website modification, or broader disruption. The scale of PHP use and rapid AI-assisted vulnerability discovery increase pressure on organizations with limited patching capacity.

What this model would watch

• Whether additional exploitation or confirmed compromises are reported.
• Which PHP versions are officially confirmed as vulnerable.
• How quickly governments, companies, hosting providers, and small-site operators apply the patch.
• Whether further websites or online services experience outages during remediation

Thesis

AI-assisted discovery of two critical PHP flaws triggered worldwide site outages and urgent patching to prevent remote server takeovers.

Claims (10)

1. Two critical PHP vulnerabilities were found with AI tools.France 24“Security firm Calif found the flaws in August using OpenAI’s GPT-5.6 Sol model.”
2. Wiz called the flaws among the most severe in PHP and arguably in software history.France 24“It called the flaws "among the most severe vulnerabilities discovered in PHP, and arguably in software history".”
3. The NSA advised organizations to patch PHP immediately or take systems offline.Al Jazeera““Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities,” the NSA said.”
4. The Dutch National Cyber Security Center took its own sites offline as a precaution.CNBC“The Dutch cybersecurity agency itself went offline, saying it had done so as a precaution because of the vulnerabilities.”
5. Cloudflare observed millions of exploitation attempts within hours of the disclosure.France 24“That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.”
6. PHP powers roughly 70-75 % of websites whose programming language is identifiable.CNBC“PHP runs roughly 75% of websites whose programming language can be identified, according to web technology tracker W3Techs.”
7. France’s Interior Ministry temporarily deactivated local-government administrative websites.CNBC“France's Interior Ministry said it had temporarily taken local government administrative websites offline while awaiting a security fix.”
8. The PHP Foundation said the flaws were among the most severe it had encountered in over a decade.France 24“Volker Dusch, a security engineer at the foundation, told the Wall Street Journal it was the most serious problem PHP had faced in more than a decade.”
9. The flaws allow remote command execution on servers without any authentication.Al Jazeera“The two loopholes mean an attacker can remotely run commands on a server running old PHP code over the internet, without needing a password or legitimate account access.”
10. Details leaked a day before the planned patch release, prompting pre-emptive shutdowns.France 24“Details leaked online Tuesday, a day before the planned release of the fix, prompting the rush to take sites offline before hackers could exploit them.”

Left open

• Which exact PHP versions are vulnerable
• How many sites remained offline after the patch became available
• Whether AI-assisted attacks have already succeeded against unpatched servers

Stakes

Millions of servers running PHP could be exposed to unauthenticated remote code execution, risking data theft, defacement or ransomware at internet scale.

What this model would watch

• Evidence of successful exploitation in the wild
• Volume of sites still running unpatched PHP versions
• Additional AI-discovered vulnerabilities in other widely used software
• Coordinated patching response by major hosting and CMS providers