Global Outages After AI Uncovers Major PHP Software Flaws

Governments and companies worldwide have shut down websites and scrambled to install emergency patches after artificial intelligence uncovered critical security flaws in PHP, a foundational programming language that powers roughly 70 to 75 percent of all websites globally.

The Flaws And Discovery

The crisis involves two memory-safety vulnerabilities, CVE-2026-109618 and CVE-2026-109619, hidden in PHP's core engine for years. These flaws allow attackers to bypass usernames and passwords entirely, access servers without authorisation, steal sensitive data, or execute malicious code. While a core developer raised out-of-memory concerns during a 2024 audit, fixing the issue was delayed to maintain backward compatibility. In August 2026, researchers independently exposed the flaws using advanced AI tools. Ryan Austin of Calif used OpenAI's GPT-5.6 Sol model through the "Patch the Planet" project, while Wiz Research used its Wiz Atlas tool alongside Google's Gemini 4 Argon and OpenAI's GPT-5.6 Sol. Technical details leaked online on Tuesday ahead of an emergency security release on Wednesday.

Global Impact And Responses

The discovery sparked international advisories and service outages. In the United States, the White House was informed, and Amazon's security chief reported decoy system exploit attempts on October 17, warning of broad exploitation in the wild. The NSA and FBI urged organizations to isolate affected systems. In Europe, Finland, the Netherlands, Edinburgh council, the BBC, and Scotland's public health boards took public-facing websites offline, while the UK National Cyber Security Centre issued warnings. Japan's Prime Minister Sanae Takaichi urged immediate patching, while finance and health ministries plus major private firms like Mizuho Financial Group, ANA Holdings, Japan Airlines, East Japan Railway, and Seven-Eleven Japan suspended online services. South Korea raised its private-sector cybersecurity alert level. Wikimedia also took down systems, and roughly 1.5 million internet hosts running unfixable PHP versions face ongoing risks.

Context

Programming languages like PHP form the invisible backbone of the internet, meaning software vulnerabilities in their core engine can affect millions of unrelated platforms simultaneously. When automated artificial intelligence tools can scan millions of lines of legacy code to find hidden programming errors faster than human auditors, it fundamentally changes the speed and scale at which global cybersecurity crises unfold.