A major security scare involving PHP, software used to run much of the internet, has forced government agencies and businesses to suspend websites while racing to fix two critical vulnerabilities.
Japanese Prime Minister Sanae Takaichi urged website operators to install emergency security updates or consider temporarily suspending vulnerable services.
The flaws can allow attackers to execute malicious instructions on vulnerable servers without logging in. Artificial intelligence helped researchers uncover them, but Amazon says it detected a suspected exploitation attempt four days before the fixes became public.
The episode has exposed how quickly an obscure software weakness can become a global problem.
PHP security scare: Why governments took websites offline
PHP runs behind the scenes of websites, processing requests and interacting with applications and databases. It is used by roughly 70% of websites whose server-side programming language can be identified.
Two flaws, CVE-2026-109618 and CVE-2026-109619, each carry a critical severity score of 9.2 out of 10. Under certain conditions, hackers can exploit weaknesses in PHP’s memory handling to seize control of servers without a password.
Finland, the Netherlands and France temporarily restricted government services. The Wikimedia Foundation also suspended some systems, while Japanese financial group Mitsubishi UFJ halted selected online services.
These shutdowns were precautions, not evidence that those organisations were successfully hacked. Japanese officials reported no related damage at the time of their statement.
University of Surrey cybersecurity professor Alan Woodward warned in The Guardian: “There is this race and some people unfortunately don’t even know they are in the race.”
He said poorly maintained sites could remain exposed for months after larger operators deploy fixes.
How AI uncovered a threat hidden for years
Security researchers used AI tools to uncover vulnerabilities buried inside PHP’s internal operations for more than a decade.
OpenAI said researcher Calif identified a flaw using GPT-5.6 Sol. Google-owned Wiz independently identified and reported both weaknesses using several tools, including Google’s Gemini 4 Argon.
The vulnerabilities involve how PHP handles memory when processing web requests. Successful exploitation can allow outsiders to run code or extract sensitive information, potentially threatening databases and customer records.
But the AI companies did not independently patch PHP. Its maintainers led the engineering work and issued emergency security updates on 21 October, supported by researchers and infrastructure providers.
Raghu Nandakumara, an executive at cybersecurity company Illumio, told Associated Press: “Speed without control creates a new kind of security problem.”
AI can shorten the time needed to identify dangerous bugs, but can also help attackers analyse newly published fixes before organisations have installed them.
Amazon’s early warning shows danger remains
Amazon’s threat intelligence team said its MadPot decoy network detected an attempt to exploit the PHP weaknesses on 17 October, four days before public disclosure.
The activity originated from an anonymised internet address, but Amazon could not establish how the suspected attacker learned about the bugs. It did not report that its customers were breached.
After disclosure, Cloudflare observed millions of exploitation attempts across its network. Those attempts are not confirmed successful intrusions.
“We are seeing early attacks emerging and are updating mitigations as new vectors show up,” Cloudflare technology chief Dane Knecht said, according to ABC News.
PHP developers released fixes in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Older unsupported branches require upgrades or suitable vendor-maintained fixes.
Firewalls provide temporary protection, not a substitute for patching.
AI helped expose a decades-old danger. Whether it becomes a prolonged security crisis now depends on how quickly website operators install the fixes.
The post What is the PHP security scare? How OpenAI, Google and Amazon raced to contain it appeared first on Invezz
