AI Discovers Critical Cybersecurity Flaw Threatening 70% of the Internet, Causing Global Shutdowns

Artificial intelligence has uncovered critical cybersecurity flaws within the PHP programming language, which underpins an estimated 70% of websites globally, leading to widespread disruptions and unprecedented concerns for internet stability. These vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619 and collectively termed "PHP2Shell," carry a high severity rating of 9.2 out of 10. The flaws, which had reportedly remained undetected in PHP's codebase for over a decade, could enable unauthorized remote code execution and memory disclosure, putting numerous online platforms at risk.

The discovery was made independently by security researchers leveraging advanced AI models, including OpenAI's GPT-5.6 Sol and Google-owned cybersecurity firm Wiz. This unprecedented finding prompted immediate and urgent warnings from cybersecurity authorities worldwide, including the US National Security Agency and the Australian Cyber Security Centre. Consequently, a multitude of websites, including government services and major online platforms, underwent temporary shutdowns as organizations rushed to implement emergency patches released by the PHP Foundation.

The incident highlights a new phase in cybersecurity where AI can uncover vulnerabilities with internet-wide implications, raising both the potential for enhanced defensive capabilities and concerns about the weaponization of such AI for offensive purposes. Experts have emphasized the critical need for immediate updates to all affected PHP installations to mitigate potential exploitation by malicious actors.