Two PHP Bugs Forced Governments Offline. AI Made It Worse

By Daniel Okafor

Two security flaws in PHP scored 9.2 out of 10 and pushed parts of the public internet dark. In the Netherlands, government websites — including the national digital ID login service — became unavailable. Finland took public services offline. Wikimedia, the organisation behind Wikipedia, switched off some of its systems as well.

The shutdowns were deliberate. In most cases, no attacker forced the sites down; the operators pulled the plug themselves because staying online carried too much risk. The UK's National Cyber Security Centre had advised organisations that could not update immediately to consider taking their systems offline.

What did the bugs actually expose?

PHP runs about 70% of the websites we can track, according to Chris Stokel-Walker, the technology journalist documenting the fallout. The language works like the back-of-house team in a restaurant: the browser places the order, PHP does the cooking and delivers the meal. The two vulnerabilities handed hackers an open window into that kitchen. An attacker could enter an online shop, steal customers' addresses and passwords, or rewrite the checkout page to harvest card details.

The PHP Foundation first identified the issue in 2024. Fixing it was judged too expensive and too difficult at the time. The foundation has since admitted the delay was a "structural failure" caused by poor resource levels.

Where does AI enter the picture?

In August, researchers working with Calif, OpenAI and Wiz showed how easily AI tools could exploit the PHP weakness. Criminals caught on fast. Cloudflare chief executive Matthew Prince said his company had already seen millions of attempts to exploit the flaw.

The numbers explain the pressure. Researchers documented about 48,000 vulnerabilities across the internet in 2025. In 2026 the count has already passed 84,000, with more than two months of the year remaining — one new vulnerability every five minutes.

AI-driven systems hammer away at weak points instantly and bury human defenders in alerts they must sift by hand. AI also makes it inordinately cheap to find flaws in vast volumes of old code, while repairing that code stays slow and hard.

Is the underlying problem new?

No. Stokel-Walker has covered this cycle for more than a decade, and the mechanism has barely changed:

• 2014: Heartbleed, a flaw in OpenSSL, the software that keeps internet communications secure. At the time, two men named Steve maintained OpenSSL on a shoestring budget.
• 2021: Log4Shell, a dangerous flaw in Log4j, a logging tool that records what happens inside computer systems.
• 2024: XZ Utils, a Linux file-compression tool into which someone deliberately planted a backdoor.

In each case, small under-resourced teams working for the public good spotted the problem, acted and averted disaster. Each incident also proved how much of the web rests on a handful of exhausted volunteers.

How much old code is still running?

A 2025 UK government review found about 28% of central government technology classed as "legacy" — out of date. Some organisations could not even estimate how much old software they ran. In April, ministers admitted they could not give a comprehensive account of what had since been fixed or retired.

The remedy is unglamorous. Companies need to document what software they use, including obscure dependencies, and name who is responsible for fixing it. Paradoxically, AI can assist with that triage. But funding has to follow.

Are there signs of improvement?

A few. The OpenSSL Foundation, the not-for-profit hit by Heartbleed in 2014, received more than €400,000 from Germany's sovereign tech fund last year. The PHP Foundation has hired more staff and now uses AI to sort urgent problems from noise. Several organisations deployed fixes before the current issue went public.

The structural answer remains the one rarely acted on: big tech companies earning billions from free open-source software should pay properly for its maintenance, and governments should do the same. Until that happens, expect more deliberate blackouts — because the alternative, staying online unpatched, will keep looking worse.