Millions Of Websites At Risk
OpenLife News reports that websites around the world are going dark after Artificial Intelligence uncovered two critical security flaws in PHP, the programming language that powers nearly 70% of all websites whose server-side language can be identified.
What Happened
Major Japanese companies including Sega, All Nippon Airways, railway operator JR West and Mitsubishi UFJ Financial Group [MUFG Bank] suspended websites and parts of their online services by Thursday as authorities across Asia called for urgent security updates. Japan’s Finance Ministry also suspended some website content while implementing security measures.
In Europe, the home page of Ireland’s The Journal, France’s Paris police website, Netherlands’ national digital identity service DigiD and House of Representatives site, Belgium’s foreign ministry, and Finland government portals went temporarily offline as a precaution.
The flaws, dubbed PHP2Shell, could allow hackers to execute malicious code remotely without authorization, disrupting services and accessing sensitive data including passwords.
How AI Found It:The vulnerabilities had remained hidden in PHP’s codebase for more than a decade and would have been extraordinarily complicated for a human hacker to exploit.
They were found independently by two cybersecurity firms:
Calif found it on August 1 using OpenAI’s GPT-5.6 Sol model as part of an OpenAI-funded audit
Wiz, owned by Google, found it weeks later using its autonomous tool Wiz Atlas, Google’s Gemini 4 Argon and GPT-5.6 Sol.
Wiz described it as among “the most severe vulnerabilities discovered in PHP, and arguably in software history.” OpenAI called it “one of the most impactful vulnerabilities in recent memory,” marking “a new phase, where AI can find security bugs with internet-scale impact.”
Why It’s Exploding Now
PHP developers released urgent fixes on October 21 and urged all users to “update immediately”.
But details leaked online Tuesday, a day before the planned release, prompting the rush.
Cloudflare CEO Matthew Prince said: “In the 10 hours before it was publicly announced, across the network we saw thousands of attempts to exploit it… That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.”
Amazon’s security chief said its honeypot systems detected exploitation attempts as early as Oct 17, four days before public disclosure.
The flaws are now being “broadly exploited in the wild.”
Global Warnings
US NSA: Rare public warning, told organizations to patch immediately or pull vulnerable systems offline
FBI Cyber Division: Warned of remote code execution risk
Japan PM Sanae Takaichi: In an X post described as an “extremely urgent request,” urged operators to prepare patches immediately, saying temporarily shutting down websites could reduce risk
Singapore CSA: Issued alert urging firms to apply fix, noting “reports of widespread exploitation attempts”
China MIIT platform: Warned of “two critical remote code execution vulnerabilities with severe impact”
What It Means For Nigeria
Nigeria is highly vulnerable. Over 80% of Nigerian government MDAs, banks, news sites, e-commerce and WordPress blogs run on PHP. Many run outdated PHP 7.x versions that may no longer receive automatic updates.
The National Information Technology Development Agency [NITDA] and ngCERT are yet to issue a formal advisory as of Thursday morning, but operators are advised to:
Check if their site uses PHP – especially WordPress, Drupal, Joomla
Update to the latest patched PHP versions released Oct 21
If patching is not immediate, take site offline as advised by NSA and Japan PM
As CyberCX executive Dimitri Vedeneev warned: “AI is lowering the cost of discovering and exploiting vulnerabilities, and organizations must be prepared to respond within hours rather than weeks.”
About Author
