Governments, municipal authorities, global corporations, and cybersecurity agencies across the globe have taken their websites offline in an emergency effort to prevent massive cyberattacks. The coordinated takedowns stem from the discovery of two critical security vulnerabilities in PHP, the core server-side programming language powering an estimated 70% of the world’s websites.

1. Scope of the Global Outages

As IT response teams scramble to apply emergency patches, a wide range of public and private sector websites have been taken offline proactively:

• Local Government Services: Municipal portals, including the Edinburgh Council website, were taken down.
• Major Media Outlets: Portions of the BBC website, such as the Doctor Who portal, were pulled offline.
• International Enterprise: Enterprise websites across Japan, Belgium, and the Netherlands have been impacted.
• Cybersecurity Regulators: In an unprecedented turn, cybersecurity authorities themselves had to take down their public-facing warning portals while securing their infrastructure.

2. How Frontier AI Discovered the Vulnerabilities

The security flaw was initially uncovered by cybersecurity researchers using frontier AI models—the most advanced category of artificial intelligence available.

The AI identified two severe flaws in PHP by mapping out a complex chain of exploitation steps. Researchers described the discovery as operating beyond typical human capability, uncovering multi-stage exploit pathways situated at the very edge of what human security analysts could practically achieve.

3. Weaponization of the AI Discovery

While the discovery was originally intended as a defensive breakthrough to allow developers to patch PHP safely, the situation quickly escalated:

1. Detection: Defensive researchers used frontier AI to identify the multi-step exploit pathway and issue a patch.
2. Reverse Engineering: Malicious actors learned of the flaw and deployed their own AI tools to reverse-engineer the exploit method.
3. Automated Targeting: Threat actors began scanning and targeting unpatched websites globally.
4. Emergency Mitigation: Because patching millions of servers takes time, organizations were forced to take their websites entirely offline to prevent total system compromise.

4. Key Takeaways

Feature	Details
Affected Language	PHP (powers ~70% of all websites globally)
Vulnerabilities Found	Two critical zero-day flaws
Discovery Method	Frontier AI mapping complex multi-step exploits
Current Risk	Threat actors using AI to automate attacks on unpatched servers
Primary Defense	Immediate application of PHP security patches or proactive offline status