AI uncovers the internet's biggest hidden threat: European governments shut down sites overnight
AI has uncovered the internet's biggest landmine: multiple European governments shut down their sites overnight. The internet experienced a rare "collective lights-out" over the past two days. It wasn't an outage — PHP blew two perfect-score vulnerabilities, and multiple European governments simply shut their websites down outright. On October 21, the PHP Foundation released an emergency update to fix CVE-2026-109618 and CVE-2026-109619.
💡 What You Will Learn
AI has uncovered the internet's biggest landmine: multiple European governments shut down their sites overnight. The internet experienced a rare "collective lights-out" over the past two days. It wasn
📜 Table of Contents
AI Uncovered the Internet's Biggest Landmine: European Governments Shut Down Sites Overnight
The internet experienced a rare "collective lights-out" over the past two days. It wasn't an outage — PHP had two maximum-severity vulnerabilities explode, and multiple European governments simply shut their websites down.
On October 21, the PHP Foundation released an emergency update fixing two critical vulnerabilities designated CVE-2026-109618 and CVE-2026-109619, with a CVSS score of 9.2. Together they're called "PHP2Shell," and they allow a single unauthenticated HTTP request to execute code directly on your server — tamper with webpages, steal data, take over the server, the whole package.
What does PHP mean in context? About 70% of the world's websites run on it — WordPress and Wikipedia are both powered by it. Affected versions range from PHP 5.4 all the way to 8.5, meaning every mainstream version released over the past decade-plus is compromised. In other words, this landmine was buried for over a decade before it finally got stepped on.
Who Dug Up the Landmine? AI
In August this year, security firm Calif used OpenAI's GPT-5.6 Sol model to scan the PHP codebase and uncovered one of the vulnerabilities. Almost simultaneously, Google's Wiz independently found the same hole using its own tooling plus the Gemini 4Argon model. Two AIs, each stumbling upon the same fifteen-year-old landmine.
So OpenAI took the lead, pulling in PHP maintainers, Cloudflare, and cybersecurity agencies from multiple countries to launch a two-month secret remediation plan codenamed "Patch the Planet" — a nod to the famous line "Hack the Planet" from the movie Hackers. The original plan was to disclose everything at the end of this month, giving global ops teams enough time to patch. OpenAI called this window the "Defender's Window."
Plans Don't Survive Contact With Reality
On October 20, vulnerability details were leaked on social media ahead of schedule, and the disclosure plan was scrapped on the spot. Before patches were even released, hackers had already caught the scent and started probing for attacks. Countries had only one option — crude but reliable: shut it all down.
Websites of five major Dutch political parties and the Port of Rotterdam's official site went temporarily offline; Finland's government public services shut down outright; all French Ministry of Interior websites entered "preventive maintenance." The next day PHP rushed out emergency releases (8.5.12, 8.4.27, 8.3.36, 8.2.35), and the BBC and Wikipedia upgraded overnight — barely containing the earthquake.
OpenAI also threw in a PHP version-checking tool to help ops teams figure out whether they'd been hit.
AI Finding Landmines: Blessing or Curse?
The most intriguing part of this whole affair: for the first time, AI proved it can beat attackers to the punch in finding a 9.2-severity vulnerability. OpenAI announced a $1 billion investment to subsidize AI security capabilities for organizations defending critical public services.
But the same coin has another side. OpenAI itself admits that the same capability, turned toward writing attack tools, will only move faster. What stings more: PHP underwent an external security audit back in 2024, and warning signs of memory issues were already spotted then. But the fix proposal got bogged down in community infighting for nearly two years — fear of breaking compatibility, fear of introducing new denial-of-service risks, fear of collateral damage to third-party extensions. Every option had a cost. The PHP Foundation's post-mortem called it a "structural failure." In the end, it took AI actually running the exploit path end-to-end to force everyone into action.
The speed at which AI finds vulnerabilities is now outpacing the speed at which humans fix them. That widening gap is the real lingering question this global shutdown leaves behind.
Has your website been upgraded? Drop a comment — were you affected by this "global shutdown"?
Written by our editorial team; tools listed here are tested or verified against public sources. Links point to official sites or GitHub repos for reference only — no paid placements.