Critical PHP Flaws Found With AI Force Governments and Major Sites Offline Across Europe and Canada

Two critical vulnerabilities in PHP, the programming language behind a large share of the web, were disclosed and patched on 21 October 2026, and governments and major sites from the Netherlands to Canada pulled pages offline while they scrambled to update. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and each rated 9.2 out of 10 for severity, let an attacker run malicious code on a vulnerable server without logging in, and they were found with the help of AI models.

What was found, and by whom

PHP's developers released urgent fixes on Wednesday and said all users were "encouraged to update immediately," according to Reuters reporting carried by The Daily Record. The patches cover the supported 8.2 through 8.5 branches, per the National News Desk report. Because the defect sits in PHP itself, updating content or plugins does not close it; operators must update PHP or ask their host to.

Two security teams claim the discovery. Reuters reported that the cybersecurity firm Calif said it found the flaws with a large language model on 1 August and had been working on a fix since. Wiz, the Alphabet-owned security company, said it found them with its autonomous AI vulnerability research tool, Wiz Atlas, together with Google's Gemini 4 Argon and OpenAI's GPT-5.6 Sol. The two firms said they coordinated with each other, the PHP team and OpenAI.

Wiz said the bugs had stayed hidden in the codebase for more than a decade. In its own blog post, Wiz wrote that "Pre-AI, this manual work would be difficult to implement and even harder to scale," according to Reuters. Wiz also called the flaws "arguably" among the most severe in software history, as relayed by LetsDataScience from Cybersecurity Dive; that is the discoverer's own characterisation.

How big is the exposure?

Estimates of the affected footprint vary, and none is a count of confirmed breaches. W3Techs data cited by Reuters puts PHP at roughly 75% of websites whose server-side language can be identified; the National News Desk cited industry estimates of nearly 70%. Censys data cited by Reuters indicates about 1.5 million of 2.6 million hosts it observed run a PHP version for which no fix exists. Palo Alto Networks identified more than 22.6 million potentially vulnerable internet-connected instances, a figure the National News Desk notes is not a count of unique websites. Not every PHP site is vulnerable, since exposure depends on configuration.

PHP also runs behind platforms such as WordPress, Drupal, Joomla and Magento, according to security firm Huntress as cited by LetsDataScience, so organisations can be exposed without knowing it. Automattic said WordPress.com and Tumblr users were safe, Reuters reported, though small sites on shared hosting face higher risk.

Who went offline

Most shutdowns were precautionary.

- **Netherlands:** the National Cyber Security Centre took itself offline, followed by the Port of Rotterdam, the government portal Overheid.nl, the KNVB football association, the websites of the five largest political parties and several hospitals, Reuters reported. - **Finland and Denmark:** Finland's state IT provider Valtori took government public network services offline. Denmark's municipal IT company Kombit shut several services, including the national school communication platform. - **France and Belgium:** the French Interior Ministry placed all its websites into preventive maintenance. - **Canada:** multiple Government of Canada pages went down for "urgent maintenance," according to the National Post as cited by LetsDataScience, and the Globe and Mail reported the Innovation, Science and Economic Development site was unavailable. - **Wikipedia and the Internet Archive:** Wikipedia's operator took an unspecified number of systems down until they could be patched, and the Internet Archive briefly went offline.

Is it already being exploited?

Reuters reported that technology firms warned some hackers were already exploiting the flaws, and security researcher Nicholas Weaver told Cybersecurity Dive that exploits were in the wild. Cloudflare reported attack traffic aimed at its customers and attempts to evade its protections; the National News Desk stressed that this does not confirm any attempt succeeded. Cloudflare's chief technology officer, Dane Knecht, called the company's firewall updates "a STOPGAP only," so patching remains the real remedy.

Guidance from cybersecurity agencies in the United States, United Kingdom, European Union, Canada, Australia and Japan was consistent: find affected PHP systems and patch. The FBI and NSA advised taking systems offline if they cannot be updated promptly. Canadian Centre for Cyber Security head Rajiv Gupta said disconnecting, patching and restoring a server could take hours or longer. The National News Desk noted nothing indicates that simply visiting an affected site infects a device.

A disclosure dispute and a policy signal

The rollout was not clean. Politico, as relayed by LetsDataScience, reported that the PHP Foundation said the flaws leaked before the planned release date and accused the software firm Chainguard of having "unilaterally broke the embargo." Chainguard had not responded to Politico's request for comment, so the claim stands unanswered.

The White House said it learned of the flaw on Friday and presented the discovery as evidence of why American leadership in AI matters, Reuters reported; it also said federal agencies were working with leading AI labs to speed a fix, per the BBC as cited by LetsDataScience. OpenAI said its models "found these vulnerabilities before attackers did," according to Politico via the same report.

Why it matters

The episode is a concrete test of whether AI models can find serious bugs in mature software faster than humans can patch them. Costin Raiu, co-founder of TLP:Black, told Reuters that AI is powering a "race to exploit" and warned the next step could be mass compromise of vulnerable web servers. Gupta said more AI-discovered vulnerabilities will likely become public and that organisations need to improve how they patch and manage risk.

The practical lesson sits with defenders. A flaw that stayed hidden for more than a decade was fixed within about three months of Calif's reported discovery, yet the long tail of unpatched servers is measured in the millions, and older PHP versions may never receive a fix, the National News Desk noted.

What we don't know yet

Several material points remain unconfirmed: the technical details of the flaws, which AI model produced which finding, how many of the exposed instances have been patched, and whether any exploitation attempts have succeeded. The headline exposure figures also differ by source and method.