Major Internet Security Flaw Discovered, Websites Shut Down Worldwide

Researchers have identified a serious security vulnerability that could put nearly 70 percent of websites on the internet at risk with the help of artificial intelligence (AI). The flaw could allow hackers to remotely execute code on servers and steal sensitive information, including passwords. Following the release of security updates to fix the vulnerability, several government and private websites worldwide were temporarily taken offline on Wednesday.

According to a Reuters report, researchers from OpenAI, Google-owned cybersecurity firm Wiz and Calif worked to identify the vulnerability, named “PHP2Shell.” The flaw in the core system of PHP, a widely used programming language for building websites, could allow attackers to gain remote control of servers.

Wiz researchers said a researcher using advanced AI models completed a complex task in just one week that would previously have taken a skilled research team several months. The research involved Wiz Atlas, Google’s Gemini 4 Argon and OpenAI’s GPT-5.6. After identifying the vulnerabilities in late August, the researchers coordinated with the relevant organisations to prepare security updates. The findings were made public on Wednesday.

The PHP Foundation has released security updates to address the flaw and urged users to install them promptly. Cloudflare warned that the vulnerability could lead to customer data exposure and disruptions to online services. The US National Security Agency (NSA) also advised PHP users to take immediate action and, if necessary, take affected systems offline.

Several government websites in Europe were temporarily shut down to apply security updates and strengthen protective measures. Researchers said the severity of the vulnerability was comparable to the “Heartbleed” security flaw discovered in 2014. The incident has raised fresh concerns about the security of critical internet infrastructure.

Researchers explained that although the vulnerabilities had existed in PHP’s systems for a long time, combining multiple weaknesses to develop an effective attack was extremely complex. Powerful AI models have reduced that complexity, making it possible to uncover security flaws that were previously difficult to identify in a much shorter time.

Experts warned that despite the announcement of the discovery and subsequent fixes, servers that have not received the security updates may remain vulnerable. Website operators have therefore been advised to install the relevant updates promptly and review their security measures.