AI audit uncovers PHP flaws so severe that government sites went dark worldwide

Details leaked a day before a fix was ready, forcing the US National Security Agency to urge organisations to patch immediately or pull systems offline. PHP runs about 70 per cent of the world's websites.

Oct 22, 2026Updated Oct 28, 20262 min read

Server racks inside a data centre bathed in blue lighting, representing web infrastructure and cybersecurity risk — Photo by Tyler on Unsplash

Security firm Calif found two critical flaws in PHP in August while carrying out an OpenAI-funded audit of the programming language’s code with OpenAI’s GPT-5.6 Sol model. Weeks later, Wiz independently identified the same flaws with help from artificial intelligence models including Google’s Gemini 4 Argon and GPT-5.6 Sol.

PHP runs about 70 per cent of the world’s websites, according to Wiz. The firm said the vulnerabilities rank “among the most severe vulnerabilities discovered in PHP and arguably in software history”.

The danger lay in what the flaws could give an attacker. They could allow someone to take over a web server without a password. The US National Security Agency said the vulnerabilities “often provide a direct path to the server's file system or database”.

Details of the vulnerabilities leaked online on Tuesday, a day before the planned release of a fix. The National Security Agency told organisations to patch immediately or pull vulnerable systems offline. PHP volunteers released the fix on Wednesday.

By then, government agencies and companies around the world had begun shutting down websites. In France, local government sites, including one for Paris police, have been inaccessible since Wednesday afternoon at the request of the French National Cybersecurity Agency.

In the Netherlands, the national digital identity service DigiD, the House of Representatives website and the national cybersecurity centre’s site went offline as a precaution. Belgium’s foreign ministry also temporarily took its websites offline. The Australian Signals Directorate said its cyber.gov.au site was among government websites affected by the flaws.

Volker Dusch, a security engineer at the PHP Foundation, told The Wall Street Journal that this was PHP’s most serious problem in more than a decade. He compared the flaws with Heartbleed, a 2014 vulnerability. OpenAI called the bug “one of the most impactful vulnerabilities in recent memory”.

The episode arrives as the number of vulnerabilities found in 2026 is on track to roughly double last year’s record total. For operators of PHP systems, the immediate task was simple and urgent: apply the fix or keep exposed systems disconnected.