Critical PHP flaws, found with the help of artificial intelligence agents, led governments and organizations in Europe and the United States to temporarily take their websites offline on Wednesday, October 21, 2026, according to the Los Angeles Times. The goal was to buy time to apply the security fixes. This matters a lot to anyone running a business in Brazil. PHP powers a huge slice of the web, and many company websites there also run on this language.
The risk is real. According to the report, the FBI cyber division warned that the flaws could allow remote code execution. In plain terms, an outsider could run commands on the server without permission. That raises the odds of sensitive data and networks being compromised. The advice from the agency was blunt: if a site cannot be updated right away, the safest move is to take it offline.
Some took that advice to the letter. The website of the Finnish government, for example, only partly worked throughout the day, with a notice telling visitors about the instability while the problem was being fixed.
The reach of the language helps explain the rush. Ismael Valenzuela, from the cybersecurity company Arctic Wolf, told the newspaper that PHP runs on about 70% of websites whose server-side language is known. He added an important caveat, though: that does not mean every PHP site is vulnerable. Even so, he said, the flaws call for immediate attention, because they put a big part of the commercial internet infrastructure at risk.
Receive the best innovation content in your email.
All the news, tips, trends, and resources you're looking for, delivered to your inbox.
By subscribing to the newsletter, you agree to receive communications from Método Viral. We are committed to always protecting and respecting your privacy.
How AI found the problem before attackers did
These AI-discovered vulnerabilities did not pop up out of nowhere. According to the Los Angeles Times, OpenAI said on its blog that over the past two months it led a coalition of researchers, security firms and other partners to handle the case. Wiz and Cloudflare are among the names mentioned.
The PHP maintainers themselves handled the fixes and the release. The partners helped with research, technical support and coordination, so the protections would be ready before the problem went public. It is the kind of behind-the-scenes work almost nobody sees, but it makes a real difference when the news finally breaks.
OpenAI described the flaws as one of the most serious security problems in recent memory. Based on the report, the company believes AI found the holes before any attacker did. It also left a warning: other major vulnerabilities have already been spotted and are being fixed, and the company expects similar findings to grow sharply in the coming months.
One detail stands out. Valenzuela told the outlet that some of these flaws had been around for more than ten years. The code did not change. What changed was the ability to find those weak spots and turn them into attacks that actually work. This trend was already showing up in cases like Anthropic and Mythos exposing critical vulnerabilities.
Speed helps, but it also worries experts
The episode comes at a tricky moment. As the newspaper points out, AI agents have been blamed for several high-profile security incidents in recent months, which raised questions about how to build this technology safely. In the PHP case, that same AI shows up on the side of the defenders.
Raghu Nandakumara, from the cybersecurity company Illumio, summed up this paradox for the outlet. In his view, AI is neither dangerous nor protective by nature. The point is that speed without control creates a new kind of problem for website security, especially when organizations cannot patch every affected system right away. The faster AI finds weak spots, the more it matters to think about what happens once they become public. The debate over how AI supercharges hackers shows the other side of the coin pretty well.
What to do now to protect Brazilian business websites
Here is the good news: the fix already exists. The PHP Foundation released the patches along with update instructions, according to the Los Angeles Times. So step one is to update.
If you do not handle the technical side, send a message today to your hosting provider or whoever maintains your site. Two questions clear up a lot: which PHP version the site uses, and whether the security update has already been applied. Popular platforms like WordPress and many online stores run on PHP. Plenty of people use the language without even knowing it.
And what if the update cannot happen right away? That is where the backup plan from the FBI comes in: consider keeping the site offline for a while. It sounds extreme, but picture an online store that shuts down for a few hours. Sure, you lose some sales. But a leak of customer data usually does far more damage, both to your bank account and to your reputation.
It also pays to check plugins, themes and old systems nobody has touched in ages. Flaws that stayed hidden for years are exactly the kind of thing that is now much easier to find.
For entrepreneurs and people working in marketing and tech, this case offers a practical lesson. If the OpenAI forecast holds up, new vulnerabilities should show up more often, and the pressure to patch fast will likely grow. Website security stops being an occasional chore and becomes part of the routine. For another angle on this story, check out the news about passwords exposed by AI agents.
