AI-Found PHP Flaws Force Websites Offline as Companies Rush to PatchAI-Found PHP Flaws Force Websites Offline as Companies Rush to Patch
Key Highlights
- Websites and public services went offline as operators raced to fix security flaws in PHP, the software behind much of the web.
- The vulnerabilities could let attackers run code on affected servers, putting private data and essential online services at risk.
- Researchers used AI tools to help uncover bugs that had remained hidden for years, raising new questions about the speed of cyber defence.
Websites and public services in several countries were temporarily taken offline this week as operators rushed to fix critical security flaws in PHP, a programming language used to run a large share of the internet. The vulnerabilities could allow attackers to run their own code on affected servers and potentially access sensitive information.
The disruption matters to African businesses and public agencies because PHP is widely used behind websites, online shops and content management systems. Organisations running their own servers need to confirm which PHP versions they use and apply the fixes released by the language's maintainers.
What the security flaws could allow
The vulnerabilities, described in security reporting as PHP2Shell, could allow remote code execution. In plain terms, an attacker may be able to make an affected server run unauthorised commands without first logging in. Depending on the system and its configuration, that could expose data, disrupt services or provide a path deeper into a network.
The PHP Foundation, which supports development of the open-source language, released fixes and urged users to update. In its coordinated disclosure account OpenAI said it worked with maintainers, researchers and security providers over the preceding two months to prepare protections before public disclosure.
Reuters reported on 22 October that Cloudflare had observed millions of exploitation attempts after the vulnerabilities became public. The report said government websites and services operated by businesses in Europe and Asia had been taken offline temporarily as teams worked on updates. These reports indicate a fast-moving risk, but they do not establish that every PHP-powered website has been compromised.
AI helped researchers find the weaknesses
Security companies Calif and Wiz said AI-assisted research helped identify the flaws in PHP code. OpenAI said Calif used GPT-5.6 Sol as part of its work, while Wiz described using its own research tools alongside Google's Gemini model and OpenAI technology.
The discovery illustrates how AI can help security researchers examine complicated software and demonstrate whether a weakness can be exploited. The same capability can also lower the effort needed by attackers to study a publicly disclosed flaw, particularly once details and patches become available.
The bugs were found before public disclosure, giving maintainers time to prepare fixes. The immediate challenge now is ensuring that organisations install the relevant updates rather than assuming that a patch being available makes their systems safe.
What African organisations should do
Website owners should identify whether their infrastructure runs PHP and establish which versions are in use. Those who manage their own servers should follow the PHP Foundation's release guidance and their hosting provider's instructions, test the update where appropriate, and apply it promptly.
Businesses using managed hosting should ask their provider whether the affected systems have been patched. Organisations that cannot update immediately should follow guidance from their national cybersecurity authority and hosting provider on reducing exposure, including temporarily disabling affected services where necessary.
A PHP vulnerability does not automatically mean a website built with WordPress or another content management system is compromised. The risk depends on the PHP version, server configuration, exposed components and whether the required fixes have been applied. Hosted platforms may also manage server-level updates on customers' behalf.
Why this matters for publishers and online businesses
For a news publisher, retailer or service provider, a precautionary shutdown can interrupt sales, audience access and customer support. A successful attack could carry more serious costs, including data exposure, recovery work and loss of trust. Smaller organisations may face particular difficulty if they rely on shared hosting or lack dedicated security staff.
Mwenendo has previously reported on foreign investors selling KSh 2.1B of KCB shares as Kenyan investors bought more, a reminder that digital infrastructure and market confidence are part of the wider environment in which businesses operate.
This PHP incident is a separate security issue, but it reinforces the need for organisations to treat software maintenance as an operational responsibility.
The next priority is patching and checking exposed systems. Operators should use the PHP Foundation's official security guidance and advice from their hosting providers, while continuing to monitor for suspicious activity. The disclosure also gives businesses a practical reminder: keeping software updated is not simply an IT task when websites are central to revenue and public services.
In Summary
- What is the PHP security issue?
- Two critical vulnerabilities in PHP could allow attackers to run unauthorised code on affected servers and potentially access sensitive data.
- Who should check their systems?
- Organisations that operate PHP-based websites or manage their own PHP servers, including businesses, publishers and public agencies.
- What should website operators do?
- Check their PHP version, follow the PHP Foundation and hosting provider's guidance, and apply the relevant security updates promptly.