GOVERNMENTS and companies around the world shut down websites on Thursday as they raced to protect themselves from cyberattacks after artificial intelligence uncovered critical flaws in PHP, a widely used programming language that powers a significant portion of the internet.
News Point Nigeria reports that PHP helps run about 70 per cent of the world’s websites, ranging from online stores and news outlets to government services, according to Wiz Research, one of the cybersecurity firms that discovered the two vulnerabilities.
Read also: ACF Demands Full Details Of Nigeria-US Critical Minerals Agreement
Created in the early 1990s, PHP originally stood for “personal home page” but now means “hypertext preprocessor” and operates underneath popular web design platforms.
“These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history,” a blog post by Wiz Research stated.
The discovery highlights how increasingly powerful artificial intelligence models can identify weaknesses in back-end computer code that have gone unnoticed by human developers for years.
The development has heightened cybersecurity concerns, with the number of software vulnerabilities discovered worldwide in 2026 on course to roughly double last year’s record total.
PHP programmers released a fix on Wednesday, while the United States National Security Agency (NSA) urged organisations to patch their websites immediately or take vulnerable systems offline. Authorities in Japan and the European Union echoed the warning.
A platform affiliated with China’s Ministry of Industry and Information Technology also issued a similar advisory, warning of “two critical remote code execution vulnerabilities with severe impact” in PHP.
Only websites running PHP on their own servers are exposed to the flaws. Many large platforms are built using other programming languages or rely on operators capable of installing the fix quickly, allowing them to remain online.
Rahat Masood, a senior lecturer in cybersecurity at the University of New South Wales in Sydney, described the discovery as “quite devastating”.
The vulnerabilities could allow attackers to gain unauthorised access to servers without requiring login credentials, she told AFP.
It could allow “attackers to get into your servers without any authorisation, without any username or password,” she said.
“Once they are in the servers, they can do anything they want,” Masood added, warning that attackers could steal sensitive information or modify website content. She urged institutions to “take it seriously”.
Government agency websites in countries including Australia, Finland and the Netherlands were among those that went offline, while services operated by insurance companies, transport operators and media organisations underwent emergency maintenance.
Read also: Kano Shuts Down 35 Private Health Facilities Over Regulatory Violations
Popular applications, including a Pokémon sleep tracker, were also temporarily taken offline while the security fix was implemented. Meanwhile, the foundation responsible for running Wikipedia warned users that they could experience service outages as it worked to address the vulnerabilities.
“If you run PHP, it is imperative that you update now,” the PHP Foundation, which funds developers working on the programming language, said in a blog post.
Volker Dusch, a security engineer at the foundation, told The Wall Street Journal that the incident was the most serious security problem PHP had faced in more than a decade.
He compared it to Heartbleed, a major security flaw discovered in 2014 that triggered a worldwide rush to patch vulnerable systems.
AI Models Used to Discover Critical Vulnerabilities
Security firm Calif discovered the flaws in August using OpenAI’s GPT-5.6 Sol model as part of an OpenAI-funded audit of PHP’s code.
OpenAI said the discovery “marks a new phase, where AI can find security bugs with internet-scale impact”.
Wiz, which is owned by Google, said it independently discovered the vulnerabilities weeks later with assistance from artificial intelligence models, including Google’s Gemini 4 Argon and GPT-5.6 Sol.
The vulnerabilities had been privately reported to PHP’s developers and kept confidential while a security fix was being prepared.
However, details of the flaws leaked online on Tuesday, a day before the planned release of the fix, prompting organisations to rush to take vulnerable websites offline before hackers could exploit the weaknesses.
Steve Kerrison, a senior lecturer in cybersecurity at the Singapore campus of James Cook University, told AFP that fears of hackers using AI to exploit the PHP vulnerabilities quickly and easily had intensified the urgency of the response.
Although there has so far been little evidence of damaging attacks, experts warned that potential data breaches could trigger a wave of so-called “phishing” attacks, in which hackers use personal information to steal passwords and compromise accounts.
Kerrison said larger institutions, including government agencies and news outlets, should be able to fix their websites relatively quickly, but warned that other operators could remain vulnerable.
“There are sites, systems and people out there who will have no idea about this and still won’t for days, weeks and months,” he warned.
Read also: Ijebu Gas Leak: Ogun Govt, NUPRC Begin Fresh Investigation After Over 100 Students Fall Ill
Those at risk could include individuals running personal blogs, whose websites might be exploited to spread computer viruses, send spam messages or distribute malicious content, he added.
The incident has renewed concerns about the growing cybersecurity implications of artificial intelligence, as the same technology increasingly used to identify and fix weaknesses in computer systems could also help malicious actors exploit vulnerabilities before affected organisations have secured their networks.
