Websites shut down globally after AI finds a critical flaw affecting 70% of the internet

skynesher/E+/Getty Images

Government and company websites around the world briefly went dark and suspended some services, as operators scrambled to patch their systems after artificial intelligence helped find critical vulnerabilities in a widely used programming language.

The discovery comes as advancements in AI have raised concerns from Washington to Silicon Valley about how the technology could supercharge cyberattacks.

The US National Security Agency and Europe’s cybersecurity agency on Wednesday advised companies to take immediate action to address two critical flaws in PHP, a programming language that powers 70% of all websites in the world, including WordPress and Drupal, an open-source content management system.

The PHP Foundation, the organization behind the coding language, has released a patch for the bugs, which have been hidden in their software for years, and is urging website operators to update their systems immediately.

Popular Irish news website The Journal was temporarily offline Thursday morning while it bolstered its “defences,” it said in a notice. The Journal is Ireland’s second most-used online news source, behind only RTÉ, the national broadcaster, according to the Reuters Institute.

The flaws in PHP – which originally stood for Personal Home Page – were uncovered by teams at OpenAI , Google-owned cybersecurity company Wiz, and another cybersecurity company, Calif . The bugs, collectively called PHP2Shell, could allow attackers to hack into websites and read memory that could contain sensitive information, like passwords.

Even world leaders urged organizations to take action. Dutch Prime Minister Rob Jetten said that his cabinet was “closely monitoring the situation surrounding the vulnerabilities in PHP.”

Japan’s Prime Minister Sanae Takaichi said companies should consider suspending services if necessary in order to reduce their exposure. “Please check if your publicly available websites use PHP, and prepare to apply the fix patch that will be released tonight… as soon as possible,” she posted on X Wednesday.

Japanese airline ANA, railway operator JR West and the country’s largest bank, MUFG, were among companies that reported some webpages and services temporarily suspended.

In Europe, government websites in France, Denmark, Finland and the Netherlands, including the Dutch cyber security agency, were temporarily taken offline while security fixes were implemented.

The Wikimedia Foundation, the non-profit that operates Wikipedia, told CNN Thursday that it was “in the process of addressing security vulnerabilities in PHP,” and that a number of its systems had been taken down as a “precautionary measure.”

AI played a crucial role in finding and fixing vulnerabilities “that had remained hidden in the PHP codebase for more than a decade,” according to Wiz, which said the episode marks an “AI inflection point.”

“What AI changed was the ability to understand the weaknesses and turn them into a working exploit,” Wiz researchers wrote in a blog post Wednesday. “With frontier AI models and the right tools, a single researcher completed in a week what previously would have taken a world-class team months of work,” they added.

The bugs were discovered in late August but were disclosed to the public only on Wednesday, after PHP had come up with a fix.

The flaws could allow attackers to remotely execute code, disrupt services and expose customer data, according to web infrastructure provider Cloudflare, which has been working with the PHP Foundation, Calif, OpenAI and Wiz to address the issue.

Researchers at Wiz used Google’s Gemini 4 Argon, Wiz Atlas and OpenAI’s GPT-5.6 Sol during the research process.

Wiz researchers say the issue is on par with the Heartbleed bug from 2014, which impacted an encryption technology estimated to be used by two-thirds of the Web. Heartbleed allowed cybercriminals to access data that should have been protected.

Like Heartbleed, the researchers at Wiz say PHP2Shell could similarly serve as a turning point in cybersecurity. While the vulnerabilities existed for years, AI made it practical to deploy them.

“The underlying flaws had been present for decades, but demonstrating their exploitability required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve,” the researchers said.

“Frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit.”

– John Liu, Anna Cooban and Amy Croffey contributed reporting.

skynesher/E+/Getty Images

人工智能帮助发现了一种广泛使用的编程语言中的关键漏洞，导致世界各地的政府和公司网站短暂瘫痪并暂停了一些服务，运营商们争相修补他们的系统。

这一发现正值人工智能技术的进步引发了从华盛顿到硅谷的担忧之际，人们担心这项技术可能会极大地增强网络攻击。

美国国家安全局和欧洲网络安全机构周三建议各公司立即采取行动，解决 PHP 中的两个严重缺陷。PHP 是一种编程语言，为全球 70% 的网站提供支持，其中包括 WordPress 和 Drupal（一种开源内容管理系统）。

PHP 基金会是该编程语言背后的组织，它发布了一个补丁来修复多年来一直隐藏在其软件中的漏洞，并敦促网站运营商立即更新其系统。

爱尔兰知名新闻网站《The Journal》周四上午暂时下线，以加强其“防御措施”。该网站在一份声明中表示，《The Journal》是爱尔兰访问量第二大的在线新闻来源，仅次于国家广播公司RTÉ（爱尔兰国家电视台），数据来自路透社新闻研究所。

PHP（最初意为个人主页）的漏洞是由OpenAI、谷歌旗下的网络安全公司Wiz以及另一家网络安全公司Calif的团队发现的。这些漏洞统称为PHP2Shell，攻击者可以利用这些漏洞入侵网站并读取可能包含敏感信息（例如密码）的内存。

甚至世界各国领导人也敦促各组织采取行动。荷兰首相罗布·杰滕表示，他的内阁正在“密切关注PHP漏洞的相关情况”。

日本首相高市早苗表示，企业应考虑在必要时暂停服务以降低风险。“请检查您面向公众的网站是否使用PHP，并准备好尽快应用今晚发布的修复补丁，”她周三在X网站上发帖称。

日本航空公司全日空、铁路运营商JR西日本和日本最大的银行三菱日联金融集团等公司报告称，部分网页和服务暂时中止。

在欧洲，法国、丹麦、芬兰和荷兰的政府网站（包括荷兰网络安全机构的网站）在实施安全修复期间暂时下线。

维基媒体基金会（运营维基百科的非营利组织）周四告诉 CNN，它“正在解决 PHP 中的安全漏洞”，并且作为“预防措施”，它的一些系统已被关闭。

Wiz 表示，人工智能在发现和修复“在 PHP 代码库中隐藏了十多年的漏洞”方面发挥了至关重要的作用，并称这一事件标志着人工智能的一个“转折点”。

Wiz 的研究人员周三在一篇博客文章中写道：“人工智能改变的是人们理解漏洞并将其转化为有效攻击手段的能力。”他们补充说：“借助前沿人工智能模型和合适的工具，一名研究人员在一周内就完成了以往世界一流团队需要数月才能完成的工作。”

这些漏洞在 8 月下旬被发现，但直到周三 PHP 提出修复方案后才向公众披露。

据网络基础设施提供商 Cloudflare 称，这些漏洞可能允许攻击者远程执行代码、中断服务并泄露客户数据。Cloudflare 一直在与 PHP 基金会、Calif、OpenAI 和 Wiz 合作解决该问题。

Wiz 的研究人员在研究过程中使用了 Google 的 Gemini 4 Argon、Wiz Atlas 和 OpenAI 的 GPT-5.6 Sol。

Wiz 的研究人员表示，这个问题与 2014 年的 Heartbleed 漏洞类似，后者影响了一种据估计被三分之二的互联网用户使用的加密技术。Heartbleed 漏洞使得网络犯罪分子能够访问本应受到保护的数据。

与 Heartbleed 漏洞类似，Wiz 的研究人员表示，PHP2Shell 也可能成为网络安全领域的一个转折点。虽然这些漏洞存在多年，但人工智能使得利用这些漏洞成为可能。

研究人员表示：“这些潜在的缺陷已经存在了几十年，但要证明它们可以被利用，需要一系列极其复杂的步骤，这几乎是人类研究人员实际能够达到的极限。”

“Frontier AI 模型大幅降低了这一障碍，将长期存在的缺陷变成了可利用的优势。”

– John Liu、Anna Cooban 和 Amy Croffey 对报道亦有贡献。