GoKawiilAI tools uncover decades-old PHP flaw, forcing mass site shutdowns
Security researchers using AI models, including an OpenAI-linked group and Google-owned Wiz, discovered critical vulnerabilities in the PHP programming language that have existed for roughly 20 years. The flaws triggered outages or precautionary shutdowns at 4chan, DeviantArt, Wikipedia, Pokémon Home, Pokémon Champions, and some Dutch and Finnish government sites, while the NSA and UK's National Cyber Security Centre urged organizations to take systems offline if they couldn't patch immediately.
GoKawiil's interpretation of the reporting above, not reported fact.
The incident suggests AI tools can now surface obscure, long-hidden vulnerabilities that previously required an 'exceptionally complex chain of steps' for human researchers to exploit, according to security firm Wiz. Because PHP powers a large share of the web, including WordPress sites, this could signal a broader shift in how both defenders and attackers use AI to find and weaponize flaws in widely used infrastructure.
- PHP vulnerabilities found via AI research tools caused precautionary shutdowns across major sites and government agencies.
- The flaw had existed in PHP for about 20 years but was previously too complex for humans to easily exploit.
- Security agencies including the NSA and UK NCSC advised organizations to go offline if immediate patching wasn't possible.
Source: theverge.com — Terrence O'Brien, 2026-10-21
Published there as: “PHP: The three letters that shut down sites all over the internet today”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.