ISLAMABAD, October 23, 2026: Two critical security vulnerabilities discovered with the help of artificial intelligence have raised concerns over the safety of websites and online services worldwide, prompting emergency security measures and temporary shutdowns of government systems.
The vulnerabilities were identified in PHP, a widely used programming language that powers websites and web applications. Security specialists warn that affected systems could be exposed to unauthorised access, potentially allowing attackers to execute commands on web servers and obtain sensitive information.
The situation has prompted urgent action from cybersecurity agencies and technology companies, with authorities advising website administrators to install security updates and strengthen monitoring.
AI helps uncover critical PHP vulnerabilities
The two vulnerabilities were discovered with the assistance of artificial intelligence, highlighting the growing role of AI tools in identifying weaknesses in computer systems.
According to the reported findings, attackers could exploit the flaws under certain conditions to execute unauthorised commands on vulnerable servers.
PHP maintainers released security updates on October 21 to address the weaknesses.
Initial reports suggested that approximately 90 percent of vulnerable systems had not yet received the necessary security fixes, leaving a substantial number of websites potentially exposed.
The reported figure has not been independently verified, and the precise number of affected systems remains unclear.
Reports of attempted cyberattacks raise alarm
The disclosure of the vulnerabilities was followed by reports of widespread attempts to exploit them.
According to Reuters, Cloudflare recorded millions of suspected malicious attempts within hours of details about the vulnerabilities becoming public.
Wired also reported that attempts to exploit the weaknesses had been observed as early as October 17, before the security updates were released.
These reports suggest that attackers were actively searching for vulnerable systems, although attempted exploitation does not necessarily mean that a website or server was successfully compromised.
The distinction is significant because the discovery of a critical vulnerability does not establish that every affected website has been hacked.
UK temporarily shuts down 32 government services
The United Kingdom took precautionary measures in response to the security concerns, temporarily suspending 32 government services while four others were partially unavailable.
British authorities clarified that the shutdowns were preventive and did not necessarily indicate that the affected services had been breached.
Reports also indicated disruptions to some online services in Canada and other countries.
Finland temporarily suspended certain government web services as a precaution while security assessments and protective measures were undertaken.
A senior official at the UK’s National Cyber Security Centre reportedly described the situation as exceptional, reflecting concerns about the potential scale of exposure.
Microsoft chief executive Satya Nadella was also reported to have expressed concern about the seriousness of the situation.
Website administrators urged to install security patches
Cybersecurity agencies have urged organisations using affected PHP versions to apply the latest security updates without delay.
Administrators have also been advised to increase monitoring for suspicious activity, review server configurations and investigate potential signs of unauthorised access.
The UK’s National Cyber Security Centre recommended considering temporary shutdowns of vulnerable systems where immediate protection was not possible.
For organisations operating business websites, online stores and digital services, the incident highlights the importance of maintaining supported software versions and applying critical security patches promptly.
Security specialists emphasise that timely updates and continuous monitoring remain essential to reducing exposure to newly discovered vulnerabilities.