Websites go dark worldwide as AI exposes critical security flaws

Government agencies and companies worldwide shut down websites Wednesday after two critical flaws were disclosed in PHP, which underpins many websites. The flaws could let attackers take over web servers without a password, and the U.S. National Security Agency urged organizations to patch vulnerable systems or take them offline. PHP volunteers released a fix Wednesday, but leaked details a day earlier prompted precautionary shutdowns in several countries. Security firms found the flaws with help from AI models.

Wiz estimated that PHP runs about 70 percent of the world’s websites and described the flaws as among the most severe found in PHP.

The NSA said the flaws often provide a direct path to a server’s file system or database.

Calif found the flaws in August using OpenAI’s GPT-5.6 Sol during an OpenAI-funded audit; Wiz later found them independently with help from Google’s Gemini 4 Argon and GPT-5.6 Sol.

The flaws were reported privately to PHP developers while a fix was prepared, but details leaked online Tuesday, one day before the planned fix release.

The French National Cybersecurity Agency requested that local government websites, including the Paris police site, be taken offline; Dutch and Belgian services and Australian government websites were also affected or taken offline as a precaution.

Published Oct 22, 2026 1:17 am KST

Updated Oct 22, 2026 2:21 am KST

A screen displays the unavailable Dutch government website, mijn.overheid.nl, as cyber agencies warn that websites may be taken offline while PHP prepares a critical fix, in Berlin, Germany, Wednesday. Reuters-Yonhap

WASHINGTON — Government agencies and companies around the world shut down websites Wednesday after two critical flaws came to light involving PHP, a programming language that is the basis for a large share of the internet.

PHP sits underneath popular web design platforms, so the weaknesses potentially affect a vast range of websites, from online stores and news outlets to government services.

Wiz, one of the security firms that found the issues, estimated that PHP runs about 70 percent of the world's websites and said the flaws rank "among the most severe vulnerabilities discovered in PHP, and arguably in software history."

The US National Security Agency told organizations to patch immediately or pull vulnerable systems offline.

The flaws "often provide a direct path to the server's file system or database," the NSA said in a statement on X.

Attackers could use them to take over web servers without needing a password.

Volker Dusch, a security engineer at the PHP Foundation, told the Wall Street Journal it was the most serious problem PHP had faced in more than a decade, comparing it to Heartbleed, a 2014 flaw that set off a worldwide rush to patch.

The discovery came amid a surge in software security disclosures driven by increasingly powerful AI models, with the number of vulnerabilities found in 2026 on track to roughly double last year's record total.

PHP volunteers released a fix on Wednesday.

"If you run PHP, it is imperative that you update now," the PHP Foundation, which funds developers working on the language, said in a blog post.

Security firm Calif found the flaws in August using OpenAI's GPT-5.6 Sol model, as part of an OpenAI-funded audit of PHP's code.

Google-owned Wiz said it found them independently weeks later with help from AI models including Google's Gemini 4 Argon and GPT-5.6 Sol.

OpenAI said on X that it considered the bug "one of the most impactful vulnerabilities in recent memory," adding that it "marks a new phase, where AI can find security bugs with internet-scale impact."

Ethan Mollick, a professor at the University of Pennsylvania's Wharton School who studies AI, said that companies he talks to are struggling to keep up with the pace of patches needed to shield from AI-driven cyberattacks.

"Now consumers are going to have the same experience of getting everything updated often and fast," he wrote on X.

The flaws had been reported privately to PHP's developers and kept confidential while a fix was prepared.

Details leaked online Tuesday, a day before the planned release of the fix, prompting the rush to take sites offline.

In France, local government websites, including one for Paris police, have been inaccessible since Wednesday afternoon at the request of the French National Cybersecurity Agency, the interior ministry said.

In the Netherlands, the national digital identity service DigiD, the website of the House of Representatives and the site of the national cybersecurity center went offline as a precaution, according to Dutch public broadcaster NOS.

Belgium's foreign ministry temporarily took its websites offline as a precaution, it said on X, although the Centre for Cybersecurity Belgium had recorded no attacks on Belgian sites.

In Australia, the Australian Signals Directorate said its own cyber.gov.au site was among government websites affected by the flaws, according to public broadcaster ABC.

周三，由于PHP（许多网站的基础语言）中两个严重漏洞被披露，全球各地的政府机构和公司纷纷关闭了网站。这些漏洞可能允许攻击者在无需密码的情况下控制网络服务器，美国国家安全局敦促各组织机构修复存在漏洞的系统或将其下线。PHP志愿者于周三发布了修复程序，但此前一天泄露的漏洞细节促使多个国家采取了预防性措施，关闭了部分网站。安全公司借助人工智能模型发现了这些漏洞。

Wiz 估计全球约 70% 的网站都运行在 PHP 上，并称这些缺陷是 PHP 中最严重的缺陷之一。

美国国家安全局表示，这些漏洞通常会提供直接访问服务器文件系统或数据库的途径。

加州在 8 月份使用 OpenAI 的 GPT-5.6 Sol 进行 OpenAI 资助的审计时发现了这些缺陷；Wiz 后来在谷歌的 Gemini 4 Argon 和 GPT-5.6 Sol 的帮助下独立发现了这些缺陷。

这些缺陷已私下报告给 PHP 开发人员，同时修复程序也正在准备中，但相关细节在周二泄露到网上，比计划的修复程序发布时间提前了一天。

法国国家网络安全局要求包括巴黎警察局网站在内的当地政府网站下线；作为预防措施，荷兰和比利时的服务以及澳大利亚政府网站也受到影响或下线。

发布于2026年10月22日凌晨1点17分（韩国标准时间）

更新于2026年10月22日凌晨2:21（韩国标准时间）

周三，在德国柏林，屏幕上显示荷兰政府网站 mijn.overheid.nl 无法访问。网络安全机构警告称，在 PHP 准备关键修复程序期间，网站可能会暂时离线。路透社-韩联社

华盛顿——周三，全球各地的政府机构和公司关闭了多个网站，此前，PHP（一种构成互联网很大一部分基础的编程语言）的两个严重缺陷被曝光。

PHP 是许多流行网页设计平台的基础，因此其弱点可能会影响到各种各样的网站，从在线商店和新闻媒体到政府服务。

Wiz 是发现这些问题的安全公司之一，该公司估计 PHP 运行着全球约 70% 的网站，并表示这些缺陷“是 PHP 中发现的最严重的漏洞之一，甚至可以说是软件史上最严重的漏洞之一”。

美国国家安全局要求各组织立即修补漏洞或将存在漏洞的系统下线。

美国国家安全局在 X 上发表声明称，这些漏洞“通常会提供直接访问服务器文件系统或数据库的途径”。

攻击者可以利用它们在无需密码的情况下接管网络服务器。

PHP 基金会的安全工程师 Volker Dusch 告诉《华尔街日报》，这是 PHP 十多年来面临的最严重的问题，他将其与 2014 年的 Heartbleed 漏洞相提并论，后者引发了全球范围内的修复热潮。

这一发现正值软件安全漏洞披露激增之际，而这主要归因于人工智能模型的日益强大。预计到 2026 年，发现的漏洞数量将比去年创纪录的总数翻一番。

PHP志愿者于周三发布了修复程序。

“如果你正在运行 PHP，那么现在必须进行更新，”为 PHP 语言开发者提供资金的 PHP 基金会在一篇博客文章中表示。

安全公司 Calif 在 8 月份使用 OpenAI 的 GPT-5.6 Sol 模型发现了这些漏洞，这是 OpenAI 资助的对 PHP 代码进行审计的一部分。

Google 旗下的 Wiz 表示，几周后，在包括 Google 的 Gemini 4 Argon 和 GPT-5.6 Sol 在内的 AI 模型的帮助下，他们独立找到了这些模型。

OpenAI 在 X 大会上表示，他们认为该漏洞是“近年来最具影响力的漏洞之一”，并补充说，这“标志着一个新阶段，人工智能可以发现具有互联网规模影响的安全漏洞”。

宾夕法尼亚大学沃顿商学院研究人工智能的教授伊桑·莫利克表示，他接触过的公司都在努力跟上修补漏洞的速度，以抵御人工智能驱动的网络攻击。

“现在消费者将拥有同样的体验，即所有信息都会经常快速更新，”他在 X 上写道。

这些缺陷已私下报告给 PHP 开发人员，并在修复程序准备就绪期间一直保密。

修复程序计划发布前一天，相关细节于周二在网上泄露，导致各网站纷纷紧急下线。

法国内政部表示，应法国国家网络安全局的要求，法国地方政府网站（包括巴黎警察局的网站）自周三下午起一直无法访问。

据荷兰公共广播公司 NOS 报道，荷兰国家数字身份服务 DigiD、众议院网站和国家网络安全中心网站出于安全考虑而下线。

比利时外交部在 X 上表示，出于谨慎起见，暂时关闭了其网站，尽管比利时网络安全中心尚未记录到比利时网站遭受任何攻击。

据澳大利亚广播公司（ABC）报道，澳大利亚信号局表示，其网站 cyber.gov.au 也是受这些漏洞影响的政府网站之一。