Dozens of high-profile global websites, government portals & online platforms have pre-emptively gone offline or pulled services.

Following the emergency disclosure of two critical, AI-discovered vulnerabilities in the PHP programming language today, some of the world biggest websites have been taken offline.

Dubbed “PHP2Shell” (tracked as CVE-2026-109618 and CVE-2026-109619), the memory-management flaws allow unauthenticated remote code execution, giving hackers a way to seize complete control of servers without a password. Because PHP powers roughly 70% of the internet, global cybersecurity agencies like the US National Security Agency (NSA) and the UK’s National Cyber Security Centre (NCSC) issued urgent directives to system administrators: apply the emergency patch immediately or pull vulnerable web assets offline!

A wide range of notable organisations have taken down major parts or the entirety of their websites to secure their infrastructure:

Affected Websites and Digital Services include:

• Government & Public Sector Portals:
  • The Netherlands: The Dutch national cybersecurity agency pulled its own website offline as a precaution. The Dutch citizen hub mijn.overheid.nl was also temporarily rendered unavailable.
  • Finland: The Finnish government temporarily shut down its public-facing web services to safeguard state servers.
  • Local UK Government Councils: Regional authorities, including Edinburgh Council, Oxfordshire County Council, and Hillingdon Council, took their consumer web platforms down.
• Media & Web Infrastructure:
  • The BBC: The UK broadcaster took select web pages and digital assets offline to prevent exploitation.
  • Wikipedia & Wikimedia Foundation: The Wikimedia Foundation reported pulling an unspecified number of backend systems offline while security updates were deployed.
  • The Internet Archive: The sprawling digital library briefly took its systems offline to insulate its data stores from early automated attack waves.
• Entertainment, Community & Gaming Platforms:
  • Gaming Networks: Digital ecosystems reliant on PHP web services saw sudden closures, notably Nintendo’s companion apps Pokémon Home and Pokémon Champions.
  • Major Content Hubs: Popular image-sharing and forum ecosystems like DeviantArt and 4chan experienced targeted service blackouts or downtime during the mitigation window.

The Role of AI in “Bugmageddon”

The security flaws had remained quietly hidden in the PHP codebase for over a decade. They were surfaced in August 2026 by cybersecurity firm Calif using OpenAI’s GPT-5.6 Sol model during a funded code audit. Weeks later, Google-owned cybersecurity firm Wiz independently uncovered the same bugs using its autonomous AI tool alongside Google’s Gemini 4 Argon.

The incident has been described by cyber experts as the start of a “new phase” in tech, where powerful AI models can expose vulnerabilities with internet-scale impact in mere days. Security routers like Cloudflare have reported seeing early automated exploit attempts in the wild, making fast deployment of the PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 updates imperative.