Global Web Outage as AI-Found PHP Flaws Trigger Emergency Takedowns

Key points

• Two critical vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, were patched on October 21, 2026.
• The flaws allow unauthenticated remote code execution and memory disclosure, affecting all PHP versions from 5.4 onward.
• Cybersecurity firm Wiz and OpenAI used frontier AI models to identify and exploit these flaws, which had remained undetected for over a decade.
• Governments in Finland, the Netherlands, and the UK, along with entities like the BBC and Wikimedia, have taken websites offline as a precaution.
• The US National Security Agency and the UK's National Cyber Security Centre advised organizations to take systems offline if immediate patching was not feasible.

Background

Earlier reports indicated that the vulnerabilities were leaked before their scheduled disclosure, prompting an emergency patch release at 14:00 UTC on October 21. The flaws were originally scheduled for disclosure on October 22 but were moved up due to the leak. While only supported PHP versions 8.2 through 8.5 receive fixes, the vulnerabilities potentially affect all versions from PHP 5 onward, impacting over 1.3 million internet-connected hosts.

How outlets are covering it

Wiz emphasizes the role of AI in uncovering these flaws, stating that frontier models were critical to making the exploitation process practical. They describe the vulnerabilities as the 'most severe ever discovered' by AI. The BBC highlights the widespread impact, noting that roughly 70% of the internet is affected, though it cannot verify this figure. The US National Security Agency and the UK's National Cyber Security Centre focus on the immediate need for organizations to take systems offline if they cannot patch immediately. The White House noted that federal agencies are working with leading AI labs to speed up the fix. Cybersecurity expert Don Smith from Sophos warned that the use of PHP is pervasive and often hidden, making it a priority target for hackers. Cloudflare's CTO, Dane Knecht, reported seeing early attacks emerging and updating mitigations as new vectors show up.

Why it matters

The incident underscores the growing role of AI in both discovering and exploiting cybersecurity vulnerabilities. The widespread impact of the PHP flaws highlights the critical need for organizations to regularly update their software and to have contingency plans for taking systems offline in the event of a critical vulnerability. The incident also raises concerns about the potential for AI to lower the barrier for scaling attacks across different deployments, changing the economics of both discovery and exploitation.

What to watch

Organizations are urged to apply the PHP security update and to continuously monitor for security updates from third-party software vendors. The NCSC advised that once the update is installed, organizations should look out for signs that an attacker might have already gained a foothold. The PHP Foundation has issued the update only for the latest versions, with people using PHP 8.1 or older being urged to upgrade. The incident may lead to a reevaluation of how vulnerabilities are defined and prioritized in the AI era.