Bad days for the global Internet
(Dan Tri) - Many government agencies and businesses around the world had to close a series of websites on October 21 after two serious security vulnerabilities related to PHP were discovered.
PHP serves as the foundation underneath popular web design systems. Therefore, this weakness threatens to affect a wide range of websites, from online stores, news agencies to government public services.
A French government website was inaccessible on October 21 (Photo: Reuters).
Wiz, one of the security companies that discovered these vulnerabilities, estimates that PHP powers about 70% of the world's websites. Experts say they are among "the most serious vulnerabilities ever discovered in PHP, and perhaps in the history of the software industry."
The US National Security Agency (NSA) recommends that organizations immediately patch or disconnect affected systems from online.
"These vulnerabilities often open a path to direct access to the server's file system or database. An attacker can exploit them to take control of a web server without needing a password," the NSA said in a statement on the social network Twitter.
Volker Dusch, security engineer at the PHP Foundation, said this is the most serious incident PHP has faced in more than a decade. He also compared it to the 2014 Heartbleed vulnerability that sparked a worldwide patching race.
The discovery comes amid a surge in software security announcements powered by AI models, with the number of vulnerabilities found in 2026 expected to double last year's record.
PHP programmers quickly released a fix on October 21. “If you are running PHP, it is imperative to update immediately,” the PHP Foundation emphasized in a blog post.
Security firm Calif discovered the vulnerabilities in August using OpenAI's GPT-5.6 Sol model. Wiz said they also independently found the vulnerabilities a few weeks later with the help of AI models including Google's Gemini 4 Argon and GPT-5.6 Sol.
"These vulnerabilities are among the most impactful in recent times. The above discovery marks a new phase where AI can find security flaws that have an impact on an Internet-wide scale," OpenAI shared in a post on Twitter.
The PHP Foundation released an emergency security update on October 21 (Photo: dpa).
In France, many local government websites, including those of the Paris police, have been taken offline.
In the Netherlands, the national digital identity service DigiD, the website of the House of Representatives and the website of the National Cyber Security Center proactively disconnected to limit risks. In Australia, the Australian Signals Agency said its website was also among the affected government websites.
Wikimedia Foundation warns users that they may experience disruptions and says it has proactively disconnected many support services until they can be safely patched.
Several Pokémon apps, including Pokémon HOME, Pokémon Champions and Pokémon Sleep, were also temporarily down for emergency maintenance. Meanwhile, the operator of the Japanese game Umamusume announced that it is conducting maintenance to fix the PHP vulnerability discovered on its server.