AI-discovered PHP bugs force global shutdowns of major websites and government agencies
Critical vulnerabilities in the PHP programming language, identified using AI, caused widespread outages across the internet. Major platforms like Wikipedia, 4chan, and DeviantArt, alongside Dutch and Finnish government agencies, took sites offline. The bugs, present for 20 years, were previously difficult to exploit but became accessible via advanced AI models. Security firms recommend immediate updates or temporary offline status to mitigate risks.
Key points
- Critical vulnerabilities in the PHP programming language, which powers 69.3% of known server-side websites, triggered widespread outages across the global web.
- Major platforms including Wikipedia, 4chan, DeviantArt, and Pokémon Home were taken offline, while Dutch and Finnish government agencies also suspended sites as a precaution.
- The bugs had existed for approximately 20 years but were recently exploited using AI models that simplified a complex chain of steps previously difficult for human researchers.
- The National Security Agency and the UK’s National Cyber Security Center advised organizations to take systems offline if immediate updates were not feasible.
- Security firm Wiz noted that the vulnerabilities, described as RCE via OOM corruption, represent a shift in how obscure bugs are discovered and weaponized.
- The event highlights the growing reliance on AI for security auditing and the potential for rapid, large-scale disruptions in critical web infrastructure.
A wave of critical vulnerabilities in the PHP programming language has forced significant portions of the internet to go offline, affecting major platforms and government agencies worldwide. The bugs, which have existed for approximately two decades, were recently identified with the aid of artificial intelligence, making them easier to exploit than previously thought. As a result, high-traffic sites such as Wikipedia, 4chan, and DeviantArt, along with gaming platforms like Pokémon Home, temporarily suspended operations to mitigate the risk of remote code execution.
The impact extended beyond commercial websites to public sector infrastructure. Government agencies in the Netherlands and Finland took their digital services offline as a precautionary measure. The National Security Agency and the UK’s National Cyber Security Center issued guidance suggesting that organizations consider taking systems offline entirely if immediate patching was not feasible. This response underscores the severity of the threat, which security firm Wiz described as requiring an exceptionally complex chain of steps to exploit before the advent of powerful AI models.
PHP remains a foundational technology for the web, supporting 69.3% of all websites with known server-side programming languages, including those built on WordPress. The incident highlights how AI is transforming cybersecurity by uncovering and weaponizing long-standing, obscure bugs. For global users, the outage serves as a reminder of the fragility of the internet’s underlying infrastructure and the accelerating pace at which new vulnerabilities can emerge and spread.
Sources
The WireByte editorial team synthesises technology news from multiple primary sources, verifies the facts, and links every source. Articles are produced with AI assistance and reviewed under our editorial policy.
