Govt agencies, companies shut websites over security flaws

Government agencies and companies across the world shut down websites on Wednesday, October 21, 2026, after two critical flaws came to light involving PHP, a programming language that is the basis for a large share of the internet.

PHP sits underneath popular web design platforms, so the weaknesses potentially affect a vast range of websites, from online stores and news outlets to government services.

Wiz, one of the security firms that found the issues, estimated that PHP runs about 70 per cent of the world’s websites and said the flaws rank “among the most severe vulnerabilities discovered in PHP, and arguably in software history.”

The United States National Security Agency told organisations to patch immediately or pull vulnerable systems offline.

The NSA said in a statement on X that flaws “often provide a direct path to the server’s file system or database.”

Attackers could use them to take over web servers without needing a password.

A security engineer at the PHP Foundation, Volker Dusch, told the Wall Street Journal it was the most serious problem PHP had faced in more than a decade, comparing it to Heartbleed, a 2014 flaw that set off a worldwide rush to patch.

JAMB plans to add critical thinking, life skills to UTME

The discovery came amid a surge in software security disclosures driven by increasingly powerful AI models, with the number of vulnerabilities found in 2026 on track to roughly double last year’s record total.

“If you run PHP, it is imperative that you update now,” the PHP Foundation, which funds developers working on the language, said in a social media post.

Security firm Calif found the flaws in August using OpenAI’s GPT-5.6 Sol model, as part of an OpenAI-funded audit of PHP’s code.

Google-owned Wiz said it found them independently weeks later with help from AI models including Google’s Gemini 4 Argon and GPT-5.6 Sol.

OpenAI said on X that it considered the bug “one of the most impactful vulnerabilities in recent memory,” adding that it “marks a new phase, where AI can find security bugs with internet-scale impact.”