Millions of websites at risk. Governments shut down services, AI helped detect vulnerabilities

Several countries have disabled websites due to critical security vulnerabilities in PHP, affecting public services in Belgium, the Netherlands, Finland, France, and Germany. The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, received a high severity rating of 9.2. Experts warn that cybercriminals may exploit these weaknesses for attacks, with the NSA advising organizations to shut down systems if they cannot apply patches immediately. The PHP development team has released security updates, but many sites still run outdated versions. AI played a role in discovering these vulnerabilities, with OpenAI coordinating efforts among security researchers. The situation highlights long-standing issues in internet infrastructure maintenance, as many organizations fail to update their systems promptly.