Governments, companies, and public institutions across the world voluntarily took their websites offline beginning October 21 after security researchers using AI tools discovered two critical vulnerabilities in PHP, the server-side programming language that underpins an estimated 70% of all websites. The flaws, collectively dubbed "PHP2Shell" by the cybersecurity community, could allow unauthenticated attackers to remotely execute code on vulnerable servers — effectively handing them full control without ever logging in.

The discovery was made by research teams at AI firms Calif and Wiz, whose researchers used advanced AI agents to identify flaws that had gone undetected for more than a decade because the technical complexity of exploiting them had previously required extensive manual effort. By October 22, Cloudflare had already recorded millions of attempted exploits. The U.S. National Security Agency issued an emergency advisory urging organizations to patch immediately or take affected servers offline, a recommendation that European and Australian cybersecurity agencies echoed.

Government websites in Canada, the U.K., and across continental Europe went dark as a precautionary measure while patches were applied. In Canada, the federal government confirmed it had temporarily pulled several sites offline, with provincial government portals in Newfoundland and Prince Edward Island also affected. The Bangladesh Bank's website remained offline as of Friday evening due to the vulnerability, according to local reports.

The episode has intensified debate inside the cybersecurity community about the double-edged nature of AI-powered vulnerability research: the same tools that allowed defenders to find the flaw could dramatically lower the barrier for attackers to discover and exploit similar bugs in the future. Security firms urged all PHP operators to apply the available patches without delay.