By Hamza Faisal

Government websites and public services across four continents went dark on Wednesday as the fallout from two critical flaws in PHP — found by AI-powered security researchers — spread around the world. From the Paris police website to the Netherlands' national digital identity service, officials pulled portals offline as a precaution while racing to apply emergency patches.

An unprecedented wave of precautionary blackouts

In France, local government websites, including the site for Paris police, have been inaccessible since Wednesday afternoon at the request of the French National Cybersecurity Agency, the interior ministry said. In the Netherlands, the national digital identity service DigiD, the website of the House of Representatives and the site of the national cybersecurity center went offline as a precaution, according to public broadcaster NOS. Belgium's foreign ministry temporarily took its websites offline, posting on X that the Centre for Cybersecurity Belgium had recorded no attacks on Belgian sites. In Australia, the Australian Signals Directorate said its own cyber.gov.au site was among the government websites affected by the flaws.

AI found the flaw — AI could also exploit it

The flaws were discovered in August by security firm Calif using OpenAI's GPT-5.6 Sol model, as part of an OpenAI-funded audit of PHP's code. Google-owned Wiz said it found the bugs independently weeks later with help from AI models including Google's Gemini 4 Argon and GPT-5.6 Sol. The flaws were reported privately to PHP's developers and kept confidential while a fix was prepared, but details leaked online on Tuesday, a day before the planned release — triggering a rush to take sites offline before attackers could strike. "Pre-AI, this manual work would be difficult to implement and even harder to scale. With AI this is no longer a barrier," Wiz warned, adding that AI tools could let hackers reverse-engineer the vulnerability with minimal effort and mass-compromise unprotected servers.

OpenAI said on X that the bug was "one of the most impactful vulnerabilities in recent memory," adding that it "marks a new phase, where AI can find security bugs with internet-scale impact." PHP volunteers released fixes on Wednesday, and the PHP Foundation, which funds developers working on the language, warned site owners: "If you run PHP, it is imperative that you update now."

The new normal: update often and fast

The episode is part of a surge in AI-driven security disclosures — the number of vulnerabilities found in 2026 is on track to roughly double last year's record total. "Now consumers are going to have the same experience of getting everything updated often and fast," Wharton professor Ethan Mollick wrote on X. PHP underpins an estimated 70% of the world's websites, according to Wiz, which is why two flaws — both scoring 9.2 out of 10 in severity — could put so much of the internet at risk at once.

By Hamza Faisal