Government agencies and companies worldwide have temporarily shut down websites as they race to fix critical security flaws in PHP, a programming language used by millions of websites.
The vulnerabilities were discovered with the help of artificial intelligence (AI), prompting urgent warnings from cybersecurity experts and the United States National Security Agency (NSA).
Wiz, one of the cybersecurity firms that identified the flaws, estimates that PHP code powers about 70 per cent of websites worldwide, including online stores, news outlets and government services.
The company described the vulnerabilities as “among the most severe vulnerabilities discovered in PHP, and arguably in software history”.
PHP developers released a security fix on Wednesday, while the NSA urged organisations to update their systems immediately or take vulnerable websites offline.
How the PHP vulnerabilities threaten websites
The flaws affect websites running PHP on their own servers. Many large platforms built with other programming languages, or operated by providers able to install the fix quickly, were able to remain online.
Rahat Masood, a senior lecturer in cybersecurity at the University of New South Wales in Sydney, described the discovery as “quite devastating”.
Speaking to AFP, Masood warned that the vulnerabilities could allow attackers to access servers without authorisation or login credentials.
“Once they are in the servers, they can do anything they want,” she said, citing the risks of sensitive information being stolen and website content being altered.
She urged affected institutions to “take it seriously”.
The incident highlights growing concerns about the cybersecurity risks associated with increasingly powerful AI models, which can identify weaknesses in computer code that have remained undetected by humans for decades.
The number of software vulnerabilities discovered worldwide in 2026 is on course to roughly double last year’s record total, according to the report.
### Government websites taken offline
Government websites in countries including Australia and the Netherlands were among those temporarily taken offline as organisations worked to secure their systems.
Insurance companies, transport operators and media organisations also carried out emergency maintenance.
Japan’s prime minister urged businesses to respond “with great urgency”, while South Korea’s government directed technology departments to update their software.
The PHP Foundation, which funds developers working on the programming language, also issued an urgent warning.
“If you run PHP, it is imperative that you update now,” the foundation said in a blog post.
Volker Dusch, a security engineer at the foundation, told The Wall Street Journal that the incident was the most serious security problem PHP had faced in more than a decade.
He compared it to Heartbleed, a major security vulnerability discovered in 2014 that triggered a worldwide effort to patch affected systems.
AI models identify critical security flaws
Security firm Calif discovered the vulnerabilities in August using OpenAI’s GPT-5.6 Sol model during an OpenAI-funded audit of PHP’s code.
OpenAI described the flaws in a post on X as “one of the most impactful vulnerabilities in recent memory”.
The company added that the discovery “marks a new phase, where AI can find security bugs with internet-scale impact”.
Wiz, which is owned by Google, said it independently discovered the vulnerabilities weeks later with assistance from AI models, including Google’s Gemini 4 Argon and GPT-5.6 Sol.
Ethan Mollick, a professor at the University of Pennsylvania’s Wharton School who studies AI, said companies were struggling to keep pace with the software updates required to defend against AI-driven cyberattacks.
“Now consumers are going to have the same experience of getting everything updated often and fast,” he wrote on X.
Security details leaked before the fix
The vulnerabilities had initially been reported privately to PHP developers and kept confidential while a security fix was prepared.
However, details leaked online on Tuesday, a day before the planned release of the patch, prompting organisations to take vulnerable websites offline before hackers could exploit the flaws.
In France, local government websites, including the Paris police website, were made inaccessible at the request of the French National Cybersecurity Agency, according to the interior ministry.
The Wikimedia Foundation, which operates Wikipedia, warned users of possible service disruptions while it addressed the vulnerabilities. It said many supporting services had deliberately been taken offline until they could be patched safely.
Some popular applications were also temporarily taken offline during the security response, including a Pokémon sleep-tracking app.
The incident has underscored the growing challenge facing organisations as AI-assisted security research accelerates the discovery of vulnerabilities and increases pressure on technology teams to deploy fixes quickly.
