A town square where every building is shut with a CLOSED sign. Gem kneels at a hole with a huge magnifying glass and says, "Good news. We found the hole." Chickadee says, "Bad news. So can anyone." Behind them, a line of people in hoodies waits with the same magnifying glass.

The Same Capabilities

October 22, 2026

AI found two flaws hidden in the code behind much of the web. Governments took their own websites down to be safe.

PHP is the hidden code that runs a huge share of websites, including every site built on WordPress. The two flaws let a stranger take over a website from the outside, no password needed. They had been sitting in PHP "for more than a decade," says Wiz, one of the companies that found them.

August 1. Calif, a security company working in an OpenAI program, finds the first part using OpenAI's AI, GPT-5.6 Sol.
August 19. Wiz, a security company Google owns, finds it on its own, using Google's AI Gemini 4 Argon, OpenAI's GPT-5.6 Sol and a tool of its own.
October 20. The people who make PHP say a fix is coming the next day. Both flaws are rated 9.2 out of 10 for danger.
October 21, morning. The EU's cyber team tells websites that can't get the fix in time to think about switching off. Finnish government sites, French government sites and the Port of Rotterdam go dark, and so does the Dutch House of Representatives.
October 21, later. The fix comes out. Websites still on older versions of PHP, 8.1 and before, get no fix.
Has anyone broken in yet? Australia's cyber agency says it knows of no attacks. Cloudflare, which guards a lot of websites, says it has already seen some. Not settled.
70%. Wiz says 70% of the internet is affected. It does not say how it counted.

The AI that finds a flaw can just as easily help someone use it. OpenAI says so itself: "the same capabilities can also help attackers rapidly develop offensive tools and exploits."

You decide what it contains