Technology
• Analysis
What Is PHP? AI Findings Force Websites Offline Worldwide
PHP, the early-1990s programming language that helps run an estimated 70 percent of the world's websites, is at the centre of a global security scramble after AI tools found critical flaws in its code, prompting many organisations to take sites offline Thursday.
By Haut Monde Post
• October 22, 2026
• 3 Min Read
The language running most of the web
The question of what is PHP has suddenly become urgent for site owners around the world. PHP is a computer programming language created in the early 1990s whose name originally stood for Personal Home Page, and it helps run an estimated 70 percent of the world's websites.
Because it underpins popular web design platforms, flaws in PHP could let hackers break into a wide range of sites, from online stores to government services.
How AI uncovered the flaws
Security firm Wiz Research, which describes PHP as a backbone of the web, said it used AI to find vulnerabilities hidden in PHP for more than a decade. In August, Wiz and other groups used cutting-edge AI models from OpenAI and Google to uncover PHP's weak spots, keeping the findings secret while a fix was developed.
Separately, security firm Calif found the flaws as part of an OpenAI-funded audit of PHP's code. OpenAI called the flaws one of the most impactful vulnerabilities in recent memory.
The response worldwide
A fix was released Wednesday, and the PHP Foundation told tech departments worldwide to act on it at once.
"If you run PHP, it is imperative that you update now."
Despite the patch, many websites were taken offline Thursday as organisations scrambled to fend off would-be hackers. Sites that went dark during the update effort ranged widely:
- •the Paris police website
- •a Pokemon sleep tracker
China's industry ministry said Thursday that organisations and users should immediately conduct a comprehensive inspection of their technology systems and upgrade to the latest secure PHP version. It also recommended strengthening cybersecurity monitoring and changing accounts, passwords and keys in a timely way.
Was anyone hacked?
Experts said the take-downs should not be read as evidence of successful attacks. Dimitrios Salampasis of Swinburne University of Technology said taking websites offline does not necessarily mean they have been hacked. Steve Kerrison, senior lecturer in cybersecurity at James Cook University's Singapore campus, said evidence so far shows nobody was actively performing attacks using the techniques available. He explained the urgency this way: people can weaponise the information very, very quickly once it is out.
The risks that remain are real. Kerrison warned that some sites, systems and people will still not know about the flaw for days, weeks and months, including user-run blogs that could spread viruses or spam. A future data breach could expose customers to phishing attacks tricking them into revealing their password to an online service.
Rahat Masood, senior lecturer in cyber security at the University of New South Wales, Sydney, noted that systems relying on third parties using PHP remain unsecure even after patching one's own systems. Kerrison added that PHP is not everything, and strong cybersecurity measures should include several layers of defences. The PHP Foundation's advice stands: everyone running PHP should update now.
