Government websites in Europe and elsewhere were taken offline on Wednesday after critical vulnerabilities in the widely used PHP programming language triggered an international security response, with agencies warning operators to apply patches immediately or suspend affected services.
PHP developers released urgent fixes for vulnerabilities that had remained hidden in the software for years and were discovered with the help of artificial intelligence. Technology companies and cybersecurity researchers said the availability of a public fix, combined with AI tools capable of reverse-engineering the flaw, could allow attackers to move quickly against unpatched servers.
The Dutch cybersecurity agency took its own website offline as a precaution. Wikipedia also said it had taken down an unspecified number of systems while they were patched, while the Internet Archive briefly went offline to address the issue. Cybersecurity agencies in Europe and Asia urged website operators to establish whether their systems used PHP and update immediately.
The vulnerability has a wide potential reach because PHP supports a large share of the public-facing internet and is integrated into major content-management and e-commerce platforms, including WordPress, Drupal, Joomla and Magento. Tiffany Farriss, interim chief executive of the Drupal Association, said all servers using PHP versions released in the last 20 years would be vulnerable and described the issue as affecting the majority of the internet.
Internet intelligence company Censys estimated that about 1.5 million of 2.6 million hosts reported running a PHP version for which no fix was available. PHP is used to assemble website content on a server before sending it to a visitor’s browser. According to web technology tracker W3Techs, it runs on roughly 75% of websites whose programming language can be identified.
The flaws were independently identified with AI assistance by cybersecurity companies Calif and Wiz. Calif said it found the vulnerabilities with the help of a large language model on August 1 and had worked with the PHP team on a fix. Wiz said its autonomous vulnerability research tool, Wiz Atlas, along with Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol, helped identify the issue. The companies said they coordinated with each other, the PHP team and OpenAI before disclosure.
The discovery has raised concern about the changing speed of vulnerability exploitation. Costin Raiu, co-founder of cybersecurity research and incident response firm TLP:Black, described the situation as an AI-powered “race to exploit” and warned of a possible mass compromise of vulnerable web servers. Lukasz Olejnik, a visiting senior research fellow at King’s College London, said AI-assisted exploitation could occur almost instantly because of the scale of PHP’s deployment.
Amazon security chief CJ Moses said the company detected an attempted exploit against one of its decoy systems on October 17, four days before public disclosure. The attempt came from an anonymous internet address, although Amazon said it was unclear how the actor learned about the vulnerabilities while they remained under embargo. Amazon reported further attempts by multiple actors after disclosure and said the flaws were being broadly exploited in the wild, while noting that it was not yet clear whether the attempts would have succeeded against real websites.
The White House said it had been made aware of the flaw on Friday. Dutch Prime Minister Dick Schoof said he was monitoring the situation, while Japanese Prime Minister Sanae Takaichi urged website owners to check whether their live sites used PHP and prepare to apply the new fix. Operators were advised to keep affected websites offline until the patches could be safely installed.
