Governments across Europe and Asia temporarily took some official websites offline this week after researchers disclosed two critical security flaws in PHP, the programming language that underpins most of the internet, according to Al Jazeera. The United States National Security Agency issued a rare public warning on Wednesday, telling organizations that use PHP to prepare for an update addressing the two vulnerabilities. The agency said sites that could not be patched right away should be taken down.
The flaws, collectively called PHP2Shell, were found with the help of artificial intelligence models. Security firm Calif, working alongside OpenAI, reported the first one on August 11, and Wiz, a security company owned by Alphabet, reported the second on August 24, Al Jazeera reports.
Why it matters
PHP runs the large majority of websites, so a pair of exploitable holes in the language reaches far beyond any single company or agency. Wiz described the findings as among the most serious vulnerabilities ever discovered in PHP and, in its assessment, in the history of software, according to Al Jazeera. The firm said the underlying flaws had existed for decades but that demonstrating they could actually be exploited required a sequence of steps at the limit of what human researchers could realistically carry out.
Both flaws work by reaching into parts of memory without authorization and using that access to execute malicious code. An attacker could send commands to a server running outdated PHP over the internet without a password or a legitimate account, Al Jazeera reports. That combination explains why authorities treated the disclosure as an operational emergency rather than a routine patch notice.
A coordinated shutdown across borders
Responses came quickly and in several forms. Germany's Federal Ministry for Digital Transformation and Government Modernisation said it removed some sites as a preventative step. France's Ministry of the Interior deactivated the official websites of local administrative offices. Authorities in Belgium, the Netherlands, Finland and the Czech Republic also said they had shut down sites in order to apply a security patch, according to Al Jazeera. Japanese Prime Minister Sanae Takaichi used social media to alert the public to the risk.
The BBC reported that websites went down worldwide as a critical PHP security update was issued, and CBC reported that Canadian government sites were among those taken offline. The Atlantic, in a piece titled "Read This Website While You Still Can," captured the strangeness of the moment for ordinary readers: services people rely on daily disappearing while administrators raced to update code.
The NSA's message was unusually direct for a spy agency. In a social media post, it said that effective immediately, all organizations using PHP for their systems should be ready for an update addressing two critical vulnerabilities, Al Jazeera reports.
Volunteers, AI and a warning about what comes next
PHP is maintained by volunteers, and the nonprofit PHP Foundation said Wednesday that the flaws were among the most severe it had encountered. The foundation urged anyone administering a website to update their code without delay.
It also pointed to a broader shift in how software weaknesses are found. AI tools allow researchers to try far more attacks than human programmers could test on their own, and the foundation warned that this cuts both ways. Tools now locate bugs faster than ever, for defenders and attackers alike, and the volume of reports will keep growing, the foundation said in a statement, according to Al Jazeera. It called on technology companies to mount a coordinated response so that online services are not badly disrupted.
OpenAI, whose models were used in the research, framed the episode as a global coordination effort, publishing material under the heading "Patch the Planet." The involvement of AI in surfacing the flaws is likely to sharpen debate over whether the same technology that helps defenders find holes will also hand attackers a faster route to them.
For site operators, the practical guidance is unchanged and urgent: update PHP, and if that cannot happen immediately, take the site offline until it can. For everyone else, the episode is a reminder of how much of the web rests on a language kept running largely by volunteers.
Watch whether other governments follow with their own shutdowns or patch deadlines, and whether the PHP Foundation's call for industry-wide coordination produces a standing mechanism for handling AI-assisted vulnerability reports.
