Trending 
Government agencies, companies, and major online services worldwide temporarily shut down websites on Wednesday after two critical security flaws were discovered in PHP, a programming language used by a large share of the internet.
PHP powers many popular website platforms and online services, meaning the vulnerabilities could affect government portals, news websites, e-commerce platforms and other internet-based systems. Cybersecurity firm Wiz estimated that PHP powers about 70 per cent of websites worldwide and described the flaws as among the most serious vulnerabilities ever identified in the programming language.
The US National Security Agency advised organisations running vulnerable PHP systems to install available security patches immediately or take affected servers offline.
Read More : US Evacuates Saudi Embassy Staff, Families
The vulnerabilities mainly affect websites that operate PHP directly on their own servers. According to cybersecurity experts, attackers could exploit the flaws to access server file systems or databases and potentially take control of web servers without needing passwords.
PHP developers released security fixes on Wednesday, with the PHP Foundation advising users to update their systems immediately.
Security firm Calif said it discovered the vulnerabilities in August during an OpenAI-funded review of PHP’s source code using OpenAI’s GPT-5.6 Sol model. Wiz, which is owned by Google, later identified the flaws independently with assistance from artificial intelligence models, including Google’s Gemini 4 Argon and GPT-5.6 Sol.
Government agencies and companies worldwide shut down websites on October 21, 2026 after two critical flaws in PHP, a programming language that underpins a large share of the internet, came to light. AFP
The vulnerabilities were initially disclosed privately to PHP developers to allow time to prepare patches. However, technical details reportedly leaked online on Tuesday, prompting organisations to shut down vulnerable services before attackers could exploit them.
Government websites in France, the Netherlands and Australia were among services temporarily taken offline. France’s Paris police website became inaccessible after guidance from the country’s cybersecurity authorities, while Dutch services including the DigiD digital identity platform, the House of Representatives website and the national cybersecurity centre were also affected.
The Wikimedia Foundation warned that users could experience disruptions across Wikipedia-related services while it secured systems. Several Pokemon applications, including Pokemon HOME, Pokemon Champions and Pokemon Sleep, also underwent emergency maintenance.
The incident comes as cybersecurity researchers report a sharp increase in software vulnerabilities being identified with assistance from increasingly capable artificial intelligence systems. Experts say organisations and internet users may now face greater pressure to install security updates quickly as both defensive researchers and cyber attackers gain access to more powerful AI tools.
