Thousands of websites were inaccessible in France and across Europe on Wednesday, October 21, after a major security vulnerability was identified with the help of AI.
Once the threat was identified, the US National Security Agency (NSA) and the UK’s National Cyber Security Centre (NCSC) recommended that all websites using PHP disconnect until they had updated the software.
Across Europe, numerous platforms were suspended, including those of all French prefectures, at the request of France’s National Agency for the Security of Information Systems (Anssi).
Public service and local government platforms were also taken offline in Finland, the United Kingdom, Germany, Denmark, the Netherlands and Belgium.
Earlier on Wednesday, the PHP Foundation, which coordinates PHP’s development and updates, published a notice detailing two vulnerabilities.
PHP, short for Hypertext Preprocessor, is a programming language created in the early 1990s by Canadian-Danish programmer Rasmus Lerdorf. It enables websites to connect with servers that host databases.
Cybersecurity firm Palo Alto Networks said on Wednesday that it had identified 22 million platforms exposed to the vulnerabilities.
“PHP powers around 70% of the world’s web,” Sagi Tzadik, a researcher at cybersecurity firm Wiz, said in a podcast published by the company on Wednesday.
A turning point for cybersecurity
On Wednesday, October 21, OpenAI, the company behind ChatGPT, said the vulnerabilities had been discovered by cybersecurity firm Calif using one of its latest models, GPT-5.6 Sol.
“Given their severity and PHP’s widespread use, we consider this one of the highest-impact computer security issues in recent memory,” the startup wrote in a post published on its website.
In addition to Calif, cybersecurity firm Wiz, a Google subsidiary, also identified the vulnerabilities, without specifying which models it had used.
“This shows how AI can uncover vulnerabilities whose consequences affect the entire internet,” OpenAI added, while warning that the same capabilities “could now help hackers rapidly develop attacks.”
New risks driven by AI
There is broad agreement that AI reached a new level in cybersecurity this year, prompting Anthropic to decide against making its Mythos model widely available, citing the risks it posed to cybersecurity.
OpenAI’s main rival has made the model available only to a handful of organizations so they can update their software to close the vulnerabilities identified by Mythos.
AI greatly expands the ability to discover flaws in software, but it also significantly reduces the time available for exposed organizations to respond to potential attacks.
Artificial intelligence allows hackers to target far more systems than before and do so within much shorter timeframes.
Wednesday’s incident followed another alert on Tuesday concerning a cryptographic protocol known as TLS, which ensures the confidentiality and integrity of communications over the internet.
Several cases have been reported in which hackers could impersonate users and decrypt communications.
“Two categories of extremely serious vulnerabilities have been disclosed within 24 hours,” Matthew Prince, head of internet services provider Cloudflare, which offers cybersecurity services, said on X.
“The first (TLS) affects everyone online,” he warned. “The second affects almost everyone who uses a server.”
