Websites shut down globally after AI finds cybersecurity flaw affecting 70% of the internet

A global web scramble, not a routine patch day

Websites shut down across parts of Europe, North America and Asia after two critical vulnerabilities were disclosed in PHP, the open-source programming language that sits behind a large share of the web [1]. The outages were largely precautionary: governments, public agencies, companies and operators took services offline while they assessed exposure, applied emergency updates or waited for managed hosting providers to patch underlying systems [1].

The subject is sometimes summarized as a flaw affecting “70% of the internet,” a shorthand based on PHP’s very broad deployment across content management systems, shared hosting, public-service portals and commercial websites [6]. That number should be read as an exposure estimate rather than proof that 70% of sites were actively compromised, but the operational effect was still unusually large because defenders could not easily tell which systems were safe without checking versions, configurations and hosting layers [6].

Reuters reported that government websites in Europe and elsewhere went offline on Wednesday, October 21, 2026, after disclosure of the vulnerabilities sent operators racing to protect systems [1]. The same report cited outages or precautionary action in the Netherlands, Finland, Denmark and France, including public-facing government services, municipal platforms and administrative websites [1].

What was found

The core issue was not a breach of one website but two vulnerabilities in PHP itself: CVE-2026-109618 and CVE-2026-109619 [3]. PHP described both as critical flaws that could allow unauthenticated remote code execution, meaning an attacker might run code on a vulnerable server without first logging in [3].

The PHP project released emergency fixes for supported branches as PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and it said there were no complete mitigations short of updating [3]. The project also warned that PHP 8.1 and older no longer receive official updates from PHP itself, leaving some operators dependent on Linux distributions, long-term-support vendors or full upgrades [3].

The vulnerabilities became known publicly as “php2shell,” a label used by security providers and infrastructure companies as they shipped detection and blocking rules [4]. Cloudflare said the flaws affected web servers running PHP 5.4 or later and could allow denial of service, remote code execution and data exposure when specially crafted HTTP traffic was processed [4].

Why AI changed the risk calculation

OpenAI said the vulnerabilities were found through a coordinated effort involving maintainers, researchers and security providers, and that Calif identified one critical flaw using GPT-5.6 Sol while Wiz independently discovered and reported both vulnerabilities [2]. OpenAI framed the episode as part of its “Patch the Planet” initiative, saying the priority after disclosure was to help organizations identify vulnerable PHP versions and apply the relevant fixes [2].

The significance is not simply that AI helped find a bug. The larger point is that frontier models may make extremely difficult vulnerability discovery and exploit development practical at a speed that traditional teams cannot easily match [2]. OpenAI said the PHP case showed how AI can uncover security flaws with internet-scale impact, while warning that the same capabilities could help attackers rapidly develop offensive tools [2].

That dual-use reality explains the intensity of the response. If defenders assume that only a small number of elite researchers can weaponize a flaw, a slower patch cycle may be tolerable; if AI systems can help many actors move quickly from disclosure to exploitation, the window for safe delay collapses [2]. Cloudflare’s deployment of web application firewall protections before public disclosure reflected that new risk model: temporary edge protections could reduce immediate exposure, but they were not a substitute for patching PHP itself [4].

Why websites went dark

Many shutdowns were defensive rather than the result of confirmed compromise. Agencies and operators faced a choice: keep vulnerable PHP services online while patches propagated, or remove them from the public internet until they could be fixed [5]. The FBI and NSA warned operators about the two critical vulnerabilities and recommended that websites be taken offline if they could not be updated immediately [5].

BBC reporting said cybersecurity agencies urged organizations unable to patch in time to consider taking sites down, contributing to temporary outages affecting bodies such as the Finnish government, Edinburgh council and some BBC pages [6]. The Netherlands’ cybersecurity agency took its own website offline, while Finland temporarily shut down public government web services [6].

The Wikimedia Foundation also said it had taken down a number of systems as a precaution while it addressed the vulnerabilities, which caused some users to lose access to parts of Wikipedia on Wednesday [6]. These examples illustrate the same defensive logic: for a remotely exploitable infrastructure flaw, temporary unavailability can be less damaging than leaving a server online and exposed [6].

Why the blast radius was so large

PHP is deeply embedded in the web’s older and newer layers alike. It powers popular content management systems, shared hosting environments, control panels, e-commerce stacks and custom applications that may not visibly advertise their dependence on PHP [6].

That ubiquity creates a discovery problem for defenders. A large organization may know about its main website, but not every legacy microsite, contractor-managed portal, old intranet bridge, forgotten upload form or bundled PHP runtime inside a commercial appliance [6]. As Sophos expert Don Smith told the BBC, the immediate challenge was not merely applying a patch but finding every place where PHP was running [6].

Small organizations face a different problem. Many do not directly manage their servers, especially when they rely on shared hosting or managed WordPress-style platforms [1]. In those cases, the site owner may have limited visibility into the PHP version and must wait for a provider to patch the underlying environment [1].

The patching race

The PHP security team had already warned on October 20 that a critical security release was scheduled for October 21 at 14:00 UTC, covering two vulnerabilities rated CVSS v4.0 9.2 [3]. After the release, the project urged all users on supported versions to update immediately to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 [3].

Cloudflare said it had been part of a coordinated effort with the PHP Foundation, OpenAI, Wiz and others, and that customers using its free or paid WAF were protected by default against php2shell starting at 03:02 UTC on October 21 [4]. That early deployment mattered because public disclosure can trigger scanning, proof-of-concept adaptation and opportunistic attacks within minutes [4].

Still, WAF rules are not a permanent fix. Cloudflare itself described its work as mitigation, while PHP’s own guidance was blunt: updating is the only safe complete solution [3][4].

What this incident means

The incident is a warning about dependency concentration. A weakness in one widely used open-source runtime can force thousands of unrelated organizations into emergency mode at the same time [1]. It also exposes the gap between software that is globally critical and maintenance ecosystems that often depend on small teams, volunteers and fragmented funding [2].

The AI angle cuts both ways. In this case, OpenAI argued that frontier AI found the vulnerabilities before attackers did, creating a “defender’s window” for maintainers and providers to prepare fixes and protections [2]. But that advantage may not last if similar capabilities become widely available to criminal groups, state actors and low-skill opportunists [2].

The immediate lesson for operators is concrete: inventory PHP exposure, confirm whether systems run patched versions, review logs for suspicious activity, and avoid treating edge filtering as a replacement for updating the runtime [3][4]. The broader lesson is strategic: the web’s security now depends not only on finding flaws faster, but on building a response system that can patch shared infrastructure at the speed AI makes exploitation possible [2].

Developments

1. Global Websites Shutdown After AI Finds Major Cybersecurity FlawWRTV · Oct 22, 2026, 5:00 PM · 9/10
2. AI Finds Cybersecurity Flaw Affecting 70% of Internet, Causing Global ShutdownsCTV News · Oct 22, 2026, 2:10 PM · 8/10
3. AI Detects Critical Internet Flaw Causing Global ShutdownsYahoo Tech · Oct 22, 2026, 11:55 AM · 8/10

Sources from the last 72 hours

1. [1]Government websites go dark after AI-discovered flaw sparks security scrambleOct 21, 2026, 9:28 AM
2. [2]Patch the Planet: global response coordination as agents uncover critical vulnerabilitiesOct 21, 2026, 2:00 AM
3. [3]PHP: News Archive - 2026Oct 21, 2026, 2:00 AM
4. [4]Cloudflare deploys protections against php2shell vulnerabilityOct 21, 2026, 2:00 AM
5. [5]Some websites go dark as operators address an AI-detected flaw in a web programming languageOct 21, 2026, 9:01 PM
6. [6]Websites taken down worldwide as critical cyber-security update issuedOct 22, 2026, 7:57 AM

AI-generated article based on recent web research, then preserved as a dated editorial snapshot.