By Ava BennettGovernments and corporations worked through the night into Thursday, October 22, 2026, to deploy urgent security updates after artificial intelligence agents uncovered a critical PHP vulnerability affecting roughly 70% of websites worldwide. The newly identified flaws prompted intelligence agencies to warn operators to take unpatched servers offline immediately to prevent remote takeovers.
How AI Agents Uncovered the Decade-Old Flaws
The security alert centers on two critical flaws in the PHP programming language, which underpins the vast majority of global websites and web applications. According to OpenAI, artificial intelligence agents helped discover the exposures during a two-month collaborative security effort involving coalition researchers and software security providers.
OpenAI described the discovery as one of the most consequential security issues in recent memory and noted that AI systems located the bugs before malicious hackers could exploit them. James Sullivan, Director of Cyber and Tech at the Royal United Services Institute in London, called it staggering that some of the underlying code defects had existed for more than a decade.
Sullivan explained that one flaw corrupts system memory so a server forgets specific data bits, enabling an attacker to inject and run malicious code. The second defect leaves user data stored on the system rather than deleting it, potentially allowing unauthorized actors to download or wipe sensitive records without a password.
Global Government Warnings and Service Disruptions
On Wednesday, October 21, the FBI cyber division warned that the bugs could permit unauthenticated remote code execution and advised administrators to disconnect websites if they could not install fixes right away. The PHP Foundation released official security patches and update instructions late Wednesday evening, while the European Union cybersecurity agency, ENISA, urged organizations to take immediate action.
Across the international Technology sector, public agencies temporarily suspended minor digital services as system administrators tested and applied multiple software patches. In the United Kingdom, the prime minister’s office confirmed on Thursday that experts were working alongside OpenAI and international partners while taking limited non-critical government services offline as a precaution.
In Finland, officials reported that a temporary government website disruption had been resolved by Thursday, though technicians were still restoring some missing page content. Meanwhile, authorities in Osaka Prefecture, Japan, noted that their official website’s machine translation tool was unavailable due to a system failure during the maintenance window.
Defensive Measures Across Public Networks
Japanese Prime Minister Sanae Takaichi posted a public advisory urging web administrators to verify whether their servers rely on PHP and to apply the Wednesday patch immediately. She noted that temporarily suspending web portals was an effective way to reduce exposure if administrators could not deploy the software fix right away.
Japan’s Chief Cabinet Secretary Minoru Kihara confirmed on Thursday that Tokyo had received no reports of actual cyberattack damage linked to the software flaw. Kihara added that portions of several Japanese government websites were briefly taken offline purely as a preventative measure to minimize risk.
Sullivan emphasized that while artificial intelligence can help attackers spot weaknesses, the episode proves AI is equally valuable for finding and fixing flaws defensively. He advised organizations to maintain strict cybersecurity fundamentals by cataloging exposed systems, installing software patches promptly, and enforcing two-factor authentication across all administrative accounts.
