Experts warned that AI tools could make it easier to analyse vulnerabilities, develop exploitation techniques and target large numbers of servers.

Multiple websites taken offline as cybersecurity agencies urge users worldwide to install urgent security updates

Government websites and online services across Europe and other regions went offline on Wednesday after critical vulnerabilities were discovered in PHP, a programming language widely used to power websites.

PHP developers released urgent security patches after the flaws, which had remained hidden in the software for years, were uncovered with the help of artificial intelligence. The developers urged users to update their systems immediately.

Technology companies warned that hackers could already be exploiting the vulnerabilities, raising concerns about a potential wave of cyberattacks as attackers race to take advantage of systems that remain unpatched.

Costin Raiu, co-founder of cybersecurity research and incident response firm TLP: Black, described the situation as a race to exploit the flaws, warning that vulnerable web servers could face widespread compromise.

PHP, originally known as Personal Home Page, dates back to the early 1990s and underpins major web platforms, including WordPress, Drupal, Joomla and Magento.

Tiffany Farriss, interim chief executive of the Drupal Association, said the issue could affect a significant portion of the internet, with servers running vulnerable PHP versions potentially exposed.

Cybersecurity agencies in Europe, Australia, Japan and the United Kingdom urged website operators to install the updates immediately or take affected websites offline until security patches could be applied.

AI Helps Uncover Long-Hidden Vulnerabilities

The vulnerabilities were discovered with the assistance of artificial intelligence, according to a blog post by Wiz, a cybersecurity company owned by Alphabet.

The company said the flaws had remained hidden in PHP’s codebase for more than a decade. Identifying and exploiting them would have required considerable effort from human researchers, but AI tools made the process easier to carry out and scale.

Wiz said its research used Wiz Atlas, an autonomous AI vulnerability research tool, alongside Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol. The company said it coordinated with the PHP development team, OpenAI and cybersecurity company Calif during the discovery and patch verification process.

Wiz also worked with Google Cloud, Cloudflare, Amazon Web Services, Microsoft, Automattic, Fastly, Akamai, Imperva and Vercel to help protect customers and prepare mitigation measures.

The White House said it had been informed of the vulnerability on Friday, describing the discovery as an example of American innovation strengthening national security through artificial intelligence.

Why the PHP Flaws Pose a Global Risk

PHP is widely used to process website requests, generate page content and deliver it to visitors’ browsers. The programming language is free and open-source, with maintenance supported by developers and volunteers.

According to web technology tracker W3Techs, PHP powers roughly 75 per cent of websites for which the programming language can be identified.

Its widespread use means that vulnerabilities in the software could expose a large number of websites and online services.

Lukasz Olejnik, a visiting senior research fellow at King’s College London, warned that AI-assisted hacking could accelerate the exploitation of vulnerable systems and increase the scale of attacks.

Smaller websites may face particular challenges because their owners often lack dedicated cybersecurity teams or the technical resources needed to apply updates quickly.

Websites hosted on shared servers may also remain exposed if the underlying infrastructure is managed by hosting providers and patches are delayed.

Government Agencies and Online Services Go Offline

Several countries took preventive measures after the vulnerabilities were disclosed.

In the Netherlands, the National Cyber Security Centre temporarily took its own website offline. Other organisations followed suit, including the Port of Rotterdam, the government portal Overheid.nl, the national football association KNVB and websites belonging to the country’s five largest political parties. Several hospital websites were also affected.

Danish municipal IT company Kombit suspended several services, including the national school communication platform.

In Finland, state IT services provider Valtori took government public network services offline as a precautionary measure.

France’s Interior Ministry placed all its websites under preventive maintenance while the vulnerabilities were addressed.

Japanese cloud service provider Sakura Internet also suspended a database appliance function on Wednesday.

The measures were intended to reduce exposure while operators assessed their systems and prepared to install security updates.

Security Experts Warn of Further Attacks

The public release of security patches has intensified concerns that attackers could use the disclosed information to identify and compromise systems that have not yet been updated.

Experts warned that AI tools could make it easier to analyse vulnerabilities, develop exploitation techniques and target large numbers of servers.

Website operators’ immediate priority is to identify affected PHP installations, apply relevant security updates, and follow guidance from hosting providers and cybersecurity authorities.

Organisations that cannot patch their systems immediately may need to restrict access or temporarily take affected services offline until they have appropriate protections in place.

The incident highlights the security challenges posed by vulnerabilities in widely deployed software, particularly as artificial intelligence makes advanced technical research and potential exploitation more accessible.