AI Uncovers Critical Internet Security Flaws as Websites Go Offline Worldwide

Websites and online services around the world have been taken offline as cybersecurity teams race to fix critical flaws in PHP, a programming language used by a huge share of the internet. The discovery has exposed a troubling reality: vulnerabilities that remained hidden for years can become serious threats when artificial intelligence makes them easier to exploit.

The flaws, collectively known as PHP2Shell, could allow attackers to access sensitive information, disrupt services, and potentially execute malicious code on vulnerable servers. Security agencies have urged organizations to install available fixes immediately, with some advising businesses to take affected systems offline if they cannot secure them in time.

AI Uncovered Vulnerabilities That Had Remained Hidden for Years

The cybersecurity flaws were discovered by researchers working with OpenAI, cybersecurity company Wiz, and Calif, according to the supplied reports. Their findings emerged through efforts to identify and repair weaknesses in widely used software, with artificial intelligence helping researchers investigate vulnerabilities that had resisted practical exploitation for years.

PHP has been a fundamental part of web development for decades, supporting websites, content management systems, and online services. Wiz estimates that roughly 70% of the internet could be affected by the vulnerabilities, although the BBC reported that it could not independently verify that figure. The potential scale helps explain why the discovery triggered urgent warnings across multiple countries.

According to the reports, the flaws had existed in PHP’s codebase for more than a decade. Researchers began investigating the software using advanced AI tools and found ways to exploit weaknesses that would have required substantial time and technical effort for human researchers to investigate manually. The discovery demonstrated how quickly AI can help turn a theoretical security problem into a practical attack method.

Wiz described the findings as a significant moment for cybersecurity, arguing that advanced AI models had made it possible to develop and adapt working exploits much faster than traditional methods allowed. In its blog post, the company said, “Frontier models were critical to making this process practical, enabling us to develop and adapt working exploits across multiple applications in hours.”

The research involved AI tools from multiple companies, including OpenAI and Google, alongside cybersecurity tools developed by Wiz. OpenAI also said an internal researcher had discovered the issue around the same time as researchers at the other companies. The findings were disclosed publicly alongside the release of security fixes, allowing organizations to begin addressing the vulnerabilities.

Why the PHP2Shell Vulnerabilities Are So Dangerous

The flaws involve how PHP handles computer memory during certain operations. Under specific conditions, a failure can leave data behind in memory that could subsequently be exposed or manipulated. An attacker who successfully exploits the weakness may be able to access information or interfere with a vulnerable server, depending on the system and its configuration.

The potential consequences include unauthorized access to sensitive information, disruption of online services, and remote code execution. This last capability is particularly concerning because it can allow an attacker to run malicious instructions on a vulnerable system. However, the existence of the flaws does not mean every PHP-powered website is automatically compromised, and successful exploitation can require particular technical conditions.

IBM’s Patrick Fussell explained the underlying problem to CNN using an example involving a hotel room. He compared the vulnerability to a situation where a guest checks out but their key continues to work, potentially allowing someone to return and access belongings left behind by another occupant. In a computer system, data that should no longer be accessible could remain exposed under the right circumstances.

The vulnerabilities reportedly involve conditions that can trigger memory failures and create opportunities to bypass security protections. Researchers used AI to develop methods for exploiting these weaknesses, including approaches involving compressed files and deeply nested file structures. These techniques helped demonstrate how flaws previously considered difficult to exploit could present a more immediate risk.

Even so, security experts have cautioned against assuming that an attacker can simply press a button and take control of any affected server. Exploitation depends on the circumstances surrounding a particular system, and the complexity of the attack can still limit its success. The serious concern is that AI can reduce the time and expertise needed to develop these attack methods.

Why So Many Websites Could Be Affected

PHP is widely used throughout the internet, including in websites built with popular content management systems and online platforms. Its role is often invisible to ordinary users because it operates behind the scenes, helping servers process requests and deliver the pages people see when they visit a website. This widespread use makes vulnerabilities in the language a concern for organizations across many industries.

Cybersecurity company Huntress noted that PHP supports platforms including WordPress, Drupal, Joomla, and Magento, alongside hosting services, control panels, and other software. Businesses may depend on PHP through third-party applications without realizing how many components of their infrastructure rely on it. Identifying every affected system can therefore be a substantial task.

The estimate that roughly 70% of the internet could be affected comes from Wiz, and the BBC said it could not independently verify the figure. It should not be interpreted as meaning that 70% of websites have been hacked or that every website using PHP is vulnerable. The actual exposure depends on the software versions involved, the configuration of individual systems, and whether the necessary security updates have been installed.

The possible reach nevertheless includes services that manage sensitive information or support everyday online activities. Websites handling purchases, subscriptions, bookings, and customer accounts may store valuable data on servers that depend on PHP. A successful attack against a vulnerable system could expose information or interrupt services that people and businesses rely on.

Government portals, online marketplaces, ticketing platforms, content management systems, and hosting infrastructure are among the types of systems that may require attention if they use affected software. The precise level of risk differs from one organization to another, making it essential for website operators to establish where PHP is running before deciding which systems need immediate action.

Governments and Major Organizations Take Websites Offline

The discovery prompted security warnings from agencies in several countries, with some organizations temporarily taking websites and services offline while they assessed their exposure. The measures were intended to reduce the risk of exploitation while technical teams worked to install fixes and protect vulnerable systems.

According to the supplied reports, Finland temporarily shut down its government’s public web services, while the Netherlands’ cybersecurity agency also took its website offline. The Dutch government’s National Institute for Public Health and the Environment and the country’s lower parliamentary house were also reported to have experienced website outages during the response.

The Wikimedia Foundation, which operates Wikipedia, confirmed that it was addressing the vulnerabilities and had taken some systems offline as a precaution. The organization said, “We have taken down a number of other systems as a precautionary measure until they can be safely patched,” according to the BBC report. Some users consequently experienced problems accessing parts of the online encyclopedia.

Other reported disruptions included Edinburgh council’s website and online homes for BBC programmes such as Doctor Who and The Traitors. However, the BBC noted that the affected sites had not confirmed a connection to PHP, so those outages should not automatically be attributed to the vulnerabilities. The reports also described temporary service suspensions affecting Japanese organizations, including airline ANA, railway operator JR West, and financial institution MUFG.

Japan’s Prime Minister Sanae Takaichi urged organizations to check whether their publicly accessible websites used PHP and prepare to apply the security fixes. The US National Security Agency issued similar advice, while cybersecurity authorities in Europe and Australia also urged organizations to address the flaws. The UK’s National Cyber Security Centre advised organizations to consider taking affected systems offline when immediate remediation was not feasible.

AI Is Changing the Balance Between Hackers and Defenders

For years, some software weaknesses remained difficult to exploit because identifying a theoretical vulnerability was only the beginning. Researchers still needed to determine how to turn the weakness into a reliable attack, often through repetitive coding, testing, and troubleshooting. That work could take considerable time, even when the underlying problem was already understood.

AI tools can help automate parts of this process, allowing researchers to test approaches, analyze results, and adapt techniques more quickly. Wiz argued that its research demonstrated how advanced AI could help a single researcher accomplish work that might previously have taken a highly skilled team months. This capability could change how quickly vulnerabilities are discovered and exploited.

The technology also creates an uncomfortable imbalance. Security researchers can use AI to find flaws before criminals do, but attackers may use similar capabilities to develop exploits against systems that remain unpatched. Once details of a vulnerability become public, organizations may face pressure to respond before malicious actors can take advantage of the information.

Carnegie Mellon University professor Vyas Sekar described the discovery as a warning about the potential scale of future threats. According to the supplied report, he said, “This may be the first of many. This is a wakeup call.” His concern reflects the possibility that other longstanding vulnerabilities could become easier to exploit as AI tools improve.

The PHP incident also raises questions about the assumption that complicated vulnerabilities are relatively safe because exploiting them requires too much effort. That assumption becomes less reliable when AI can automate tedious technical work. Software weaknesses that previously attracted little attention may become more attractive targets if attackers can develop working exploits more efficiently.

Why Installing the Security Patch May Not Be Enough

The PHP Foundation released fixes for the disclosed vulnerabilities, but distributing an update is only one part of the response. Organizations must identify where PHP is running, determine which systems are affected, and make sure the relevant security updates are installed. They may also need to update third-party applications, hosting products, and other services that include PHP as part of their underlying software.

The challenge becomes more complicated when businesses rely on older applications that are difficult to maintain. According to the supplied reports, the PHP Foundation released updates for newer versions, while organizations using PHP 8.1 or older were urged to upgrade. Updating legacy systems can require additional planning because applications may depend on software versions that are no longer supported.

Organizations must also investigate whether attackers accessed their systems before the fixes were installed. Applying a patch can close a known vulnerability, but it does not automatically remove malware or reverse unauthorized access that may already have occurred. Security teams therefore need to examine system logs, investigate suspicious activity, and determine whether further action is necessary.

Cloudflare chief technology officer Dane Knecht said the company was seeing early attacks emerging and was updating its defensive measures as new attack methods appeared, according to the BBC report. The warning highlights the pressure facing organizations that have not yet secured their systems, particularly now that information about the vulnerabilities is publicly available.

Website operators should identify every system using affected PHP versions, apply the relevant security updates, and consider taking vulnerable services offline if they cannot be secured promptly. They should also investigate signs of suspicious activity and monitor further advisories from PHP and third-party software providers. These measures can reduce exposure, although they cannot eliminate every cybersecurity risk.

The Internet May Face More AI-Driven Security Crises

The PHP2Shell discovery has drawn comparisons with Heartbleed, a major vulnerability disclosed in 2014 that affected OpenSSL, software used to secure internet communications. Both incidents exposed weaknesses in widely used technology, creating concerns about the security of systems that underpin everyday online activity. The latest incident adds another complication: AI can make previously difficult exploitation methods more practical.

The longer-term challenge is that the internet relies on an enormous amount of interconnected software, including applications maintained by organizations with different budgets and technical capabilities. Even companies with dedicated security teams may depend on external vendors, outdated applications, or infrastructure they do not fully control. Fixing a vulnerability across that network can take time, leaving some systems exposed after a solution becomes available.

Moving away from PHP entirely would also be a substantial undertaking for many organizations. Rebuilding existing applications around a different programming language could require considerable resources, making security updates and better maintenance more practical immediate priorities. The supplied reports emphasize the need to identify vulnerable systems and address weaknesses before attackers can exploit them.

For ordinary internet users, a website becoming unavailable does not necessarily mean it has been hacked. Some organizations deliberately suspend services to protect their systems while installing security updates. Temporary disruption can therefore be part of a defensive response rather than evidence that an attack has succeeded.

The disclosed PHP flaws have been patched in supported versions, but the wider risk depends on whether organizations apply those fixes and secure the systems that rely on the language. AI has helped expose a weakness that remained difficult to exploit for years, changing the timetable facing cybersecurity teams. The immediate test is whether website operators can close the gap before attackers use the same technology to find their next opportunity.