Artificial intelligence helped uncover two critical vulnerabilities in the PHP programming language, which powers more than 70 percent of websites worldwide. The discovery prompted a rare public warning from the United States National Security Agency, which advised organizations to take affected sites offline if they could not be patched immediately.

Government agencies across Europe, Asia and other regions responded by temporarily shutting down select websites to apply security updates. In Germany, the Federal Ministry for Digital Transformation and Government Modernisation confirmed the precautionary removal of certain sites. France’s Ministry of the Interior deactivated official pages for local administrative offices, while authorities in Belgium, the Netherlands, Finland and the Czech Republic performed similar actions. Even Japanese Prime Minister Sanae Takaichi issued a public warning about the PHP risk on social media.

The vulnerabilities, identified as PHP2Shell, were discovered by researchers at security firm Wiz in collaboration with OpenAI. Wiz reported its finding on August 24, following an earlier disclosure by Calif on August 11. Both firms noted that the flaws had existed for decades but required complex exploitation steps that pushed the limits of manual testing. AI models enabled the detection of these issues by testing a broader range of attack vectors than human analysis alone could achieve.

The PHP Foundation, which maintains the open-source language, described the vulnerabilities as among the most severe it had encountered. The group emphasized that the flaws allow attackers to execute arbitrary code on servers running outdated PHP versions without needing authentication. Exploitation hinges on unauthorized memory access that can be leveraged to run malicious commands remotely.

Cybersecurity experts caution that AI-driven vulnerability discovery will accelerate, increasing both defensive and offensive capabilities. The PHP Foundation called for coordinated patching efforts to prevent widespread service disruptions. While no active exploits have been reported, the simultaneous presence of two critical weaknesses in a ubiquitous web technology has prompted a global, preemptive response from public and private sector actors.