Global Web Outages Follow AI-Driven Discovery of Decade-Old PHP Security Vulnerabilities

Security firm Calif identified security vulnerabilities in August 2026. Calif performed the audit using the "GPT-5.6 Sol" model from OpenAI. Cybersecurity firm Wiz, a Google subsidiary, independently discovered the same flaws.

The vulnerabilities had remained undetected for more than a decade. These flaws affected PHP versions released from 2004 onward, beginning with PHP 5. The PHP security team assigned a severity rating of 9.2 out of 10 to both vulnerabilities, which the European Union Computer Emergency Response Team noted carry the potential for unauthenticated remote code execution. The US National Security Agency advised organizations to disconnect if they could not apply the fix, and Japan’s Prime Minister Sanae Takaichi urged the public to verify if their websites run on PHP.

1. The use of AI tools like GPT-5.6 Sol allowed researchers to identify vulnerabilities that had remained hidden for over a decade.

2. The PHP security team released emergency patches on October 21, 2026, immediately following the forced disclosure. This rapid deployment of fixes provided administrators with the necessary tools to secure their systems against the identified remote code execution risks.

3. The US National Security Agency (NSA) advised organizations to take systems offline if they could not immediately apply security patches. This step limited potential exploitation while administrators updated their infrastructure.

4. The Wikimedia Foundation and government IT providers, including Germany's ITZBund, moved to protect users. These organizations took services offline to install updates.

1. The PHP Foundation planned to keep vulnerability details confidential until a fix was ready. A leak on social media on October 20, 2026, forced an early announcement. The early disclosure left administrators with little time to prepare.

2. Security flaws affect every version of PHP released since 2004. These vulnerabilities expose a significant portion of the internet to potential attacks. PHP currently powers approximately 70% of websites globally. This ubiquity complicates the update process for developers and IT departments.

3. Emergency measures forced government and corporate websites offline. These outages disrupted public services and access to information. The French Interior Ministry took prefecture websites offline. The action demonstrated the vulnerability of essential digital infrastructure.

4. The PHP Foundation urges users of PHP 8.1 and older versions to upgrade their software. Many legacy systems remain difficult to update. These unsupported versions pose long-term security risks for organizations using them.