Key facts
- Two critical flaws in PHP, used by an estimated 70% of websites, were discovered using AI.
- The vulnerabilities could allow attackers to execute code, disrupt services, and expose customer data.
- The US National Security Agency and governments across Asia have issued urgent warnings and called for immediate patching.
- Major companies like Sega, ANA, and MUFG Bank took websites offline as a precaution.
Critical vulnerabilities in the PHP programming language, discovered using advanced AI tools, have prompted widespread website shutdowns and urgent security advisories across Asia and globally. The flaws, described as among the most severe in PHP's history, could allow attackers to execute code remotely, disrupt services, and expose sensitive information like passwords without needing authentication.
Researchers from Wiz, OpenAI, and other cybersecurity firms utilized AI models, including OpenAI's GPT-5.6 Sol and Google's Gemini 4 Argon, to identify the vulnerabilities in late August 2026. The PHP Foundation has released a patch, and authorities, including the US National Security Agency, are urging all organizations using PHP to update their systems immediately or take them offline.
In response, major Japanese companies such as Sega, All Nippon Airways, and MUFG Bank suspended websites and online services by Thursday, October 22, 2026. Governments worldwide are scrambling to address the issue, with Australia's National Office of Cyber Security also aware and working on patching the bug.