Governments and companies around the world shut down websites as they raced Thursday to protect themselves from hacks after artificial intelligence uncovered critical flaws in a widely used programming language called PHP.
The discovery has triggered international advisories and forced websites offline worldwide, marking a new phase in cybersecurity in which increasingly powerful AI can uncover software vulnerabilities that humans have missed for years.
PHP, which originally stood for “personal home page” but is now known as “hypertext preprocessor,” is a foundational programming language that sits beneath popular web design platforms. It helps run approximately 70 to 75% of all websites globally, spanning from online stores and news outlets to critical government services.
The current crisis stems from two critical vulnerabilities—CVE-2026-109618 and CVE-2026-109619—hidden deep within PHP’s core engine, specifically in its memory management and error handling.
CVE-2026-109618 is an out-of-memory error where PHP can leave partially initialised internal data behind if a request reaches the memory limit at the wrong moment, leading to memory corruption and potential remote code execution.
CVE-2026-109619 involves stale global state issues in which a fatal error could leave internal state pointing to memory from a previous request, allowing a later request to use that freed memory for remote code execution.
These flaws are considered memory-safety bugs that can allow attackers to access servers without authorisation, steal sensitive data, or execute malicious code, bypassing usernames or passwords entirely.
The bugs had been hiding in PHP’s source code for years. While concerns over out-of-memory errors were raised by a core PHP developer during a 2024 audit, no working exploit was discovered, and the fix was delayed due to the complexity of patching without breaking backward compatibility.
The vulnerabilities were finally exposed independently by two cybersecurity entities in August 2026, both utilising advanced artificial intelligence:
Ryan Austin, a researcher at the California-based security firm Calif, identified the flaws using as part of the “Patch the Planet” project.
Google-owned Wiz Research independently found the flaws weeks later, utilising their autonomous AI tool, Wiz Atlas, alongside and OpenAI’s GPT-5.6 Sol.
Wiz stated that pre-AI, the manual work required to study failures and refine exploitation techniques would have been difficult to scale, but with AI, this barrier has been removed.
Details of the vulnerabilities leaked online on Tuesday, 20 October, just ahead of PHP’s planned emergency security release on Wednesday. This leak fueled fears that hackers could use AI to quickly exploit the flaws at a massive scale.
To shield themselves, many countries and companies mobilised as a precaution, pulling vulnerable systems offline to prevent attackers from reaching and exploiting the flaw while administrators installed the necessary security patches.
The discovery triggered emergency responses, service outages, and strict advisories across the globe:
United States: The White House was informed of the vulnerability. Amazon’s security chief reported attempts to exploit flaws in one of its decoy systems on October 17 and warned that the flaws were being “broadly exploited in the wild”. The US National Security Agency and the urged organisations to isolate affected systems and take them offline if immediate patching is not feasible.
Europe: Governments in Finland and the Netherlands took public-facing national and local government websites offline. The UK’s National Cyber Security Centre advised organisations to check systems for malicious activity and consider taking them offline.
Japan: The crisis highlighted the country’s struggle with ageing digital infrastructure. Prime Minister Sanae Takaichi urged immediate patching, while the finance and health ministries halted certain webpages. Private entities, including Mizuho Financial Group, ANA Holdings, Japan Airlines, East Japan Railway, and Seven-Eleven Japan, suspended various online services and apps.
Asia-Pacific: South Korea raised its private-sector cybersecurity alert level and activated emergency measures.
With data showing approximately 1.5 million internet hosts running PHP versions for which no fix is available, experts warn that smaller websites run by individuals and organisations with limited technical resources could face greater risks in the coming weeks.
(With agency inputs)
