AI Uncovers Critical PHP Flaws, Triggering Global Government Website Takedowns and Cybersecurity Scramble

On October 21, 2026, government websites across Europe, Canada, and beyond went dark as operators scrambled to address two critical vulnerabilities in PHP, a programming language underpinning an estimated 70% of websites worldwide. The flaws, rated 9.2 on the CVSS v4.0 scale and enabling unauthenticated remote code execution, were discovered using AI tools by security firms including Wiz and Calif, in collaboration with OpenAI and Google models. PHP developers released emergency patches that day, but agencies urged immediate updates or temporary offline measures due to active exploitation risks.[1][2]

Dutch, French, Danish, Finnish, and Canadian government sites—including the Port of Rotterdam, Overheid.nl, hospital portals, and federal pages—were taken offline as precautions, following guidance from national cyber centers and EU CERT-EU. Similar actions occurred in the UK, Australia, and Japan, with the NSA and NCSC warning of direct paths to file systems or databases. Wikipedia and major CMS platforms like WordPress also reported disruptions.[3][4]

This incident highlights AI's dual role in cybersecurity: accelerating vulnerability discovery in legacy code hidden for years, yet underscoring risks if such capabilities fall to adversaries. It connects to prior reports of AI agents probing government systems, amplifying concerns over national security infrastructure reliant on outdated software. Patches require manual application, leaving millions of hosts exposed per Censys data.[1]