One PHP Flaw, Seventy Percent of the Web: Why Governments Took Their Websites Offline
Two critical vulnerabilities in PHP, the server-side language that runs a huge share of the world's websites, forced governments and major Japanese platforms to pull services offline overnight — and the flaw was reportedly found with OpenAI's help.
Overnight in Europe and Asia, administrators of some of the internet's most unglamorous infrastructure did something drastic: they took their own websites down. The site the Paris police use to publish curfew notices stopped opening. In Japan, game servers for titles including Granblue Fantasy and Uma Musume went into emergency maintenance, alongside Rakuten, Mercari and Niconico. The trigger was not an attack but a disclosure: two critical vulnerabilities in PHP, and a patch not yet everywhere. One Weibo user tallied the casualties — and noted how many people spent the night patching.
PHP is the server-side language that has run a huge share of the web for three decades, which is why a trending Chinese search put the exposure bluntly: "70% of the world's websites are in danger." The PHP maintainers released patches and urged immediate updates, and the White House said it was coordinating with technology companies to deploy the fix across US federal agencies and critical infrastructure. Governments pulled sites offline during patching because the window before a fix is fully deployed is precisely when attackers go to work. Global Market Broadcast summarized the official line.
The detail that caught Chinese readers was how the flaw was found. A Japanese ITmedia headline circulating on Weibo reads: "PHP vulnerability discovered using OpenAI's AI — similar discoveries to surge in coming months." As the same Weibo commenter put it, AI will probably keep turning up more flaws from here on — an observation that cuts both ways, depending on whether you are patching or probing.
The week was already a bad one for the software supply chain. On Zhihu, engineers were dissecting why Node.js, Oracle, Chrome and Linux all disclosed ultra-high-severity vulnerabilities within days of one another (the thread). Japanese netizens reached for a cultural reference point: Summer Wars, the 2009 anime in which a runaway AI crashes everything from traffic systems to a family's email — a fiction that suddenly read like a weather forecast.
The patches are out and the sites are coming back online. The open question is the one the ITmedia headline poses: when an AI can find critical flaws faster than humans can patch them, the world's maintenance window only shrinks.