Websites down: what is PHP and how has it raised AI hacking fears?

AI models helped security researchers uncover long-hidden vulnerabilities in PHP, prompting organizations worldwide to take websites offline Thursday as they applied a fix. PHP, created in the early 1990s, runs an estimated 70 percent of the world’s websites and supports platforms used by online stores and government services. Researchers said they had seen no evidence of active attacks using the techniques, but warned that some sites could remain vulnerable. Experts also cautioned that third-party systems and possible data breaches could create continuing risks.

The PHP Foundation released a fix Wednesday and urged organizations running PHP to update immediately.

Wiz and Calif found the flaws in August using AI models; Calif’s work was part of an OpenAI-funded audit of PHP code.

Websites taken offline included the Paris police website and a Pokémon sleep tracker.

Steve Kerrison said some site operators, including user-run blog owners, might not learn about the issue for days, weeks or months.

Rahat Masood said systems could remain insecure if third parties using PHP had not patched their systems.

Published Oct 22, 2026 4:54 pm KST

Updated Oct 22, 2026 5:01 pm KST

Cables at a computer server, as cyber agencies warn that websites may be taken offline while PHP prepares a critical fix, Berlin, Germany, Oct. 21. Reuters-Yonhap

TOKYO — Artificial intelligence has found critical security flaws in a major programming language called PHP, with many websites taken offline Thursday as organizations worldwide scramble to fend off would-be hackers.

As AI's fast-advancing capabilities fuel concern over the increased risk of cyberattacks, here are some questions and answers about the situation:

What is PHP and how widely used is it?

Created in the early 1990s, PHP is a computer programming language that helps run an estimated 70 percent of the world's websites.

It is "a backbone of the web," according to security firm Wiz Research, which says it used AI to find vulnerabilities hidden in PHP for more than a decade.

PHP — a name that originally stood for Personal Home Page — underpins popular web design platforms, meaning the flaws could allow hackers to break into various sites, from online stores to government services.

A fix was released Wednesday, with the PHP Foundation telling the tech departments of companies and organizations around the world: "If you run PHP, it is imperative that you update now."

That has resulted in a slew of apps and websites — from the Paris police website to a Pokemon sleep tracker — going dark as developers work to protect their underlying code from hacks.

How did AI find the flaws?

Cutting-edge AI models, such as those from US giants OpenAI and Google, were used by Wiz and other groups to uncover PHP's weak spots in August.

This was kept under wraps while a fix was developed.

OpenAI called the flaws "one of the most impactful vulnerabilities in recent memory," adding that it "marks a new phase, where AI can find security bugs with internet-scale impact".

Separately to Wiz, security firm Calif found the flaws as part of an OpenAI-funded audit of PHP's code.

"The trouble with tools like AI is that the moment all the information's out there, people can weaponize it very, very quickly," Steve Kerrison, senior lecturer in cybersecurity at the Singapore campus of James Cook University, told AFP.

"That's why everybody's acting with such urgency to respond to this issue."

Have sites already been hacked?

"Taking websites offline does not necessarily mean they have been hacked.

It can be a responsible measure to protect systems while security updates are applied," said Dimitrios Salampasis from Australia's Swinburne University of Technology.

So far "the evidence that security researchers are seeing is that nobody was actively performing attacks using the techniques available," Kerrison said.

Larger institutions, from government agencies to news outlets, should be able to fix their websites relatively quickly — but others may be left vulnerable.

"There are sites, systems and people out there who will have no idea about this and still won't for days, weeks and months," Kerrison warned.

That may include user-run blogs that could be used to spread computer viruses, spam people or distribute malicious content.

Could there be other consequences?

A data breach could affect customers in the future if their personal information is used in so-called "phishing" attacks, where someone is tricked into revealing their password to an online service.

The complex and interlinked nature of online systems, which often use third-party interfaces, means some vulnerabilities could remain even after the problem is fixed.

If the third parties use PHP, "then even though you patched yourself ... you're still unsecure," said Rahat Masood, senior lecturer in cyber security at the University of New South Wales, Sydney.

PHP isn't everything, however — strong cybersecurity measures should include several layers of defenses, Kerrison said.

人工智能模型帮助安全研究人员发现了PHP中长期隐藏的漏洞，促使全球各地的机构在周四关闭网站以进行修复。PHP诞生于20世纪90年代初，据估计，全球约70%的网站都在运行，并为在线商店和政府服务平台提供支持。研究人员表示，他们尚未发现利用这些技术发起的攻击，但警告称，一些网站可能仍然存在漏洞。专家还提醒，第三方系统和可能的数据泄露可能会带来持续的风险。

PHP基金会周三发布了修复程序，并敦促运行PHP的组织立即更新。

Wiz 和 Calif 在 8 月份利用人工智能模型发现了这些缺陷；Calif 的工作是 OpenAI 资助的 PHP 代码审计的一部分。

被下线的网站包括巴黎警方网站和一款宝可梦睡眠追踪器。

史蒂夫·克里森表示，一些网站运营者，包括用户运营的博客所有者，可能几天、几周甚至几个月都不知道这个问题。

Rahat Masood表示，如果使用PHP的第三方没有修补他们的系统漏洞，系统可能仍然不安全。

发布于2026年10月22日下午4:54（韩国标准时间）

更新于2026年10月22日下午5:01（韩国标准时间）

德国柏林，10月21日。图为一台计算机服务器上的电缆。网络安全机构警告称，在PHP准备关键修复程序期间，网站可能会暂时离线。（路透社-韩联社）

东京——人工智能在一种名为 PHP 的主要编程语言中发现了严重的安全漏洞，导致许多网站于周四下线，世界各地的组织纷纷争相抵御潜在的黑客攻击。

随着人工智能能力的快速发展，人们对网络攻击风险的增加感到担忧，以下是关于此情况的一些问答：

什么是PHP？它的应用范围有多广？

PHP 是一种计算机编程语言，诞生于 20 世纪 90 年代初，据估计，全球约 70% 的网站都使用 PHP 来运行。

安全公司 Wiz Research 称 PHP 是“互联网的支柱”，该公司表示，十多年来，他们一直利用人工智能来发现 PHP 中隐藏的漏洞。

PHP（最初是 Personal Home Page 的缩写）是许多流行网页设计平台的基础，这意味着其漏洞可能使黑客能够入侵各种网站，从在线商店到政府服务。

周三发布了修复程序，PHP 基金会告知世界各地公司和组织的技术部门：“如果您运行 PHP，则必须立即更新。”

这导致大量应用程序和网站（从巴黎警方网站到宝可梦睡眠追踪器）停止运行，因为开发人员正在努力保护其底层代码免受黑客攻击。

人工智能是如何发现这些缺陷的？

8 月份，Wiz 和其他团队利用美国巨头 OpenAI 和 Google 等公司的尖端人工智能模型，发现了 PHP 的弱点。

在找到解决方案之前，此事一直处于保密状态。

OpenAI 称这些缺陷是“近年来最具影响力的漏洞之一”，并补充说，这“标志着一个新阶段，人工智能可以发现具有互联网规模影响的安全漏洞”。

除了 Wiz 之外，安全公司 Calif 也在 OpenAI 资助的对 PHP 代码的审计中发现了这些漏洞。

“人工智能等工具的问题在于，一旦所有信息都公开出来，人们就可以非常非常快地将其武器化，”詹姆斯库克大学新加坡校区网络安全高级讲师史蒂夫·克里森告诉法新社。

“正因如此，大家才如此迫切地采取行动应对这个问题。”

网站已经被黑客攻击了吗？

网站下线并不一定意味着它们被黑客攻击了。

“在应用安全更新的同时保护系统，这是一种负责任的措施，”澳大利亚斯威本科技大学的迪米特里奥斯·萨兰帕西斯说道。

克里森说：“到目前为止，安全研究人员看到的证据表明，没有人积极利用现有技术进行攻击。”

从政府机构到新闻媒体等规模较大的机构应该能够相对快速地修复其网站，但其他机构可能仍然容易受到攻击。

“有些网站、系统和个人对此一无所知，而且可能几天、几周甚至几个月都不会知道，”克里森警告说。

这可能包括用户运营的博客，这些博客可能被用来传播计算机病毒、向人们发送垃圾邮件或散布恶意内容。

是否还会有其他后果？

如果客户的个人信息被用于所谓的“网络钓鱼”攻击，即有人被诱骗向在线服务透露密码，那么数据泄露可能会在未来影响客户。

在线系统的复杂性和相互关联性，以及它们通常使用第三方接口的特性，意味着即使问题得到解决，某些漏洞也可能仍然存在。

新南威尔士大学悉尼分校网络安全高级讲师拉哈特·马苏德表示，如果第三方使用 PHP，“那么即使你自己打了补丁……你仍然不安全”。

克里森表示，PHP 并不是万能的——强大的网络安全措施应该包括多层防御。