AI Uncovers Critical Security Flaws in Software Powering Millions of Websites, Triggering Shutdowns Worldwide

Image Credit: Amjid Ali

Government agencies and companies around the world have temporarily taken websites offline after artificial intelligence helped uncover critical security vulnerabilities in PHP, a programming language that powers a large portion of the internet. The discovery triggered an international cybersecurity response, with officials urging organisations to install security updates or disconnect vulnerable systems to prevent potential attacks.

The vulnerabilities were discovered independently in August by cybersecurity firm Calif, using an AI model, and researchers at Google-owned security company Wiz, who also used AI tools. The flaws, which had reportedly existed for years, could allow attackers to execute malicious code remotely and potentially gain access to website servers, files and databases without a password. PHP is widely used by platforms such as WordPress and Drupal, meaning the weaknesses could affect websites across government, business and other sectors.

The threat became more urgent after details of the vulnerabilities leaked online on Tuesday, October 20, shortly before the planned release of security fixes. On Wednesday, authorities and website operators in several countries moved to protect their systems. Websites and digital services in the Netherlands, France, Finland and Belgium were among those taken offline temporarily, while other organisations restricted access as they worked to apply the necessary updates.

The United States National Security Agency urged organisations to patch vulnerable systems immediately or take them offline if they could not be secured. Cybersecurity officials warned that the flaws could expose sensitive information and provide attackers with a route into affected networks. PHP developers subsequently released security patches and urged users to update their systems without delay.

The incident highlights the growing role of artificial intelligence in cybersecurity. AI tools can examine large amounts of software code and identify weaknesses that might otherwise take researchers considerable time to discover. However, the same capabilities can also help malicious actors understand vulnerabilities and develop attacks more quickly, particularly once technical details become public.

Security experts have warned that organisations face a race to update vulnerable systems before attackers can exploit them. Smaller businesses and website operators with limited technical resources may face particular challenges in identifying affected software and installing fixes promptly.

The worldwide disruption demonstrates how a vulnerability in a widely used programming language can affect services far beyond the technology sector. While temporarily shutting down websites can inconvenience users, cybersecurity authorities have stressed that protecting systems and sensitive data must take priority. The immediate focus remains on applying security patches, identifying vulnerable servers and reducing the risk of further attacks as AI continues to reshape the cybersecurity landscape.