Warning: AI Attacks Numerous Websites Worlwide

If you’ve noticed a few of your favourite websites acting strangely or going offline over the past few days, you’re not imagining it. Two critical vulnerabilities in PHP, the programming language that quietly powers roughly 70% of the world’s websites, were disclosed on Wednesday, 21 October, and the response has been nothing short of global.

What actually happened

Researchers at Wiz and Calif independently discovered two memory-handling bugs in PHP (CVE-2026-109618 and CVE-2026-109619) that had been sitting undetected for at least a decade. The danger is straightforward: a successful exploit lets an attacker run arbitrary code on a server without any authentication. That means stealing data, defacing sites, or using the compromised server as a springboard deeper into a network.

Patches were released on Wednesday afternoon, but the attackers were already moving. Cloudflare reported thousands of exploitation attempts in the ten hours before the public disclosure, jumping to tens of thousands within 45 minutes of the announcement, hundreds of thousands within two hours, and millions by Thursday. Amazon said it had detected targeting four days before the public announcement and confirmed the flaw is “now being broadly exploited in the wild.”

As of Friday morning, no confirmed successful breach had been publicly reported, but security experts caution that the full impact may take time to surface.

Why so many sites went dark

Here’s the reassuring part: most of the sites that went offline weren’t hacked. They were taken down as a precaution while patches were applied. Wikipedia, Finnish government services, the Dutch national health agency, the Dutch lower house of parliament, the UK’s Office for Budget Responsibility, Edinburgh and Oxfordshire council sites, several BBC programme pages, DeviantArt, and a host of others all fell into this category. The UK’s National Cyber Security Centre issued an “extremely high risk” warning and sent 50,000 alerts to affected organisations.

Where AI fits in

The bug had been hiding in PHP for over a decade. It was always there, but turning it into a working attack was so complicated that no human team had managed it. That’s where AI changed things.

Security researchers used AI tools to not just find the flaw, but to actually build a working exploit in a matter of days. What used to be nearly impossible for a team of experts became something a single person with the right tools could pull off.

The bigger concern is that this capability isn’t limited to defenders. Once the fix was made public, AI tools could reverse engineer it and generate new attack variants almost instantly. Attackers are already using AI to move quickly through compromised systems, grabbing passwords and security keys within hours. In short: AI made the bug exploitable, and now it’s making it exploitable at scale, which is why patching is so urgent.

A wider picture

The PHP flaws were the most visible of several security disclosures this week, including supply-chain issues in Node.js that touched companies like Netflix, PayPal, and Walmart. There’s also a broader trend at play: AI-assisted attack campaigns are surging. CrowdStrike reports that AI-agent-related attacks doubled in August and doubled again in September. The pace at which vulnerabilities are found, disclosed, and exploited is accelerating, and this week is a stark illustration of that.

It’s worth addressing the crypto angle, since the vulnerability sparked a fair amount of alarm in that space. Users are urged to exercise extra caution when visiting websites in the coming days, and security firm SlowMist issued a specific alert to exchanges, DeFi platforms, and wallet providers.
A scan of nearly 1,500 crypto-related domains found that over half had direct PHP fingerprints, meaning their websites, admin panels, airdrop claim pages, and hosted wallet services are all potentially exposed. A compromised site could, in theory, be altered to steer users into signing malicious transactions.

That said, the actual risk to crypto as a technology is far lower than the headlines might suggest. The Bitcoin consensus itself, and the underlying protocols of other major blockchains, have no dependency on PHP whatsoever. The decentralised networks continue processing blocks and validating transactions without any interference. What’s at risk is the off-chain infrastructure, the websites and services people use to interact with those networks, not the networks themselves. By comparison, traditional banks, government services, and major e-commerce platforms carry a far more concentrated and consequential exposure, since a single compromised server there can expose millions of customer accounts and financial records at once. For crypto users, the practical takeaway is to be cautious about which websites you connect your wallet to in the coming weeks, particularly smaller or less established ones that may be slow to patch.

What you should do

If you’re a regular web user, the advice is simple: stick to well-known, large sites for the next few weeks. Avoid entering passwords or card numbers on smaller or unfamiliar websites that may not have patched yet. Your existing security hygiene, unique passwords, two-factor authentication, an updated browser, remains your best defence.

If you run or manage a website, check whether it uses PHP. The fix must be applied to PHP itself on the server; updating WordPress or its plugins is not sufficient. If you can’t patch quickly, take the site offline until the fix is verified, and contact your hosting provider to confirm they’ve applied the update.

Going forward, keep an eye on any unusual activity on your accounts, particularly if you use smaller or niche online services. The full picture is still emerging, and the next few weeks will tell us just how far the damage reached.

☝Disclaimer: This article is for informational purposes only and does not constitute financial advice. Always conduct your own research and consult with a qualified financial advisor before making investment decisions.

Stay informed and level up your crypto strategy

Sign Up for the Crypto Corner Newsletter and join 10,000+ users to receive my monthly updates and market analysis and keep up to date with the latest releases and developments in the crypto arena.