French authorities advise offline measures as PHP flaw response expands
France's ANSSI advised taking affected PHP servers offline, and several public websites were suspended as a precaution.
Event / Security
PHP Security Vulnerabilities
Security vulnerabilities in the PHP programming language, which an estimated 70% of websites worldwide use, were identified in August 2026 by Wiz Research using AI models and independently by Calif during an OpenAI-funded audit. The flaws were publicly disclosed on 21 October 2026 and can allow remote command execution without a password. Many websites, including French public sites and Orange services, were taken offline to apply patches. French and EU cybersecurity bodies issued alerts. As of publication, no active exploitation had been observed.
3 reported locations
Daily activity
2 articles0 articles
2026-10-22 to 2026-10-26 · UTC publication dates
Coverage begins 22 Oct, 15:21 UTC
Follow the documented timeline or explore the related reporting.
What happened
Wiz Research used AI to identify PHP vulnerabilities in August 2026
The cybersecurity firm Wiz Research used AI models to find hidden PHP vulnerabilities in August 2026, and the findings were kept confidential while a fix was developed.
PHP powers approximately 70% of websites worldwide
PHP, a programming language created in the early 1990s, powers approximately 70% of websites worldwide, including sites built on platforms such as WordPress, Drupal and PrestaShop.
Several French public websites were suspended as a precaution
Prefectures, several ministries, impots.gouv.fr, Météo-France and Santé publique France were among the French public websites suspended preventively.
AI models were used to discover two security vulnerabilities in PHP
Advanced AI models, including models from OpenAI and Google, were used to identify two security vulnerabilities in PHP, a programming language that runs approximately 70% of websites worldwide.
Orange temporarily suspended some sites, applications and services
The French operator Orange temporarily suspended certain sites, applications and services across several of its entities, and began deploying patches on Wednesday 21 October 2026 before gradually restoring service.
Cybersecurity firm Calif independently found the PHP flaws during an OpenAI-funded audit
The cybersecurity company Calif independently discovered the same PHP vulnerabilities during an audit of PHP code funded by OpenAI.
PHP flaws could allow remote command execution without a password
The two vulnerabilities can allow an attacker to run instructions remotely on a vulnerable server without a password, potentially enabling site modification, malware installation, access to sensitive data, or use of the server as a entry point to other services.
More than 600,000 PHP servers were identified on the French internet
More than 600,000 servers using PHP were identified on the French internet.
Older PHP versions that no longer receive maintenance require migration
PHP versions that no longer receive maintenance require migration to a supported version.
PHP vulnerabilities were publicly disclosed on 21 October 2026
The PHP vulnerabilities were made public after a fix had been developed, and the disclosure was followed by disruptions to websites from Wednesday 21 October 2026.
OpenAI described the PHP flaws as among the most notable vulnerabilities of recent years
OpenAI described the PHP vulnerabilities as among the most significant of recent years and stated that they mark a new phase in which AI can find security bugs with internet-wide impact.
Security researchers observed no active exploitation of the PHP flaws at publication
As of publication, security researchers had observed no active attacks exploiting the PHP vulnerabilities using the techniques available.
CERT-FR issued an alert following publication of the PHP vulnerabilities
France's national computer emergency response team, CERT-FR, issued an alert after the PHP vulnerabilities were published.
PHP flaws have caused disruptions on millions of websites worldwide
Millions of websites worldwide have experienced disruptions as operators took sites offline to address the PHP vulnerabilities.
Orange experienced a mobile network outage unrelated to the PHP flaws
On Wednesday 21 October 2026, Orange was affected by a large mobile network outage that was not related to the PHP vulnerabilities.
EU cybersecurity bodies advised organizations to take immediate measures against PHP flaws
The European Commission's DG CNECT, ENISA, CERT-EU, Europol EC3 and the EU CSIRT network advised organizations to take immediate measures to address the critical PHP vulnerabilities.
France's ANSSI recommended taking affected PHP servers offline until patches are applied
France's national cybersecurity agency, ANSSI, recommended taking affected servers offline until security patches were applied.
Read the coverage
2 alternative perspectives
AI Models Used to Identify Two Flaws in PHP
AI models helped find two PHP flaws, disclosed 21 October 2026, with no active exploitation observed.