Government agencies and companies worldwide are rushing to shut down websites or suspend online services temporarily after two severe security vulnerabilities were found in the PHP programming language, which supports many websites globally. Artificial intelligence (AI) was used to help detect the vulnerabilities, while cybersecurity agencies in multiple countries have warned to install patches immediately or shut down unpatched systems to prevent hackers from taking control of servers.
Government agencies and numerous companies worldwide have shut down websites or suspended online services after cybersecurity researchers discovered two critical vulnerabilities in the PHP programming language, a key technology used to develop and power many websites, ranging from online stores and news outlets to government service systems.
Cybersecurity firm Wiz, a Google subsidiary, estimates that about 70% of websites worldwide use PHP, though BBC has reported it cannot independently verify this figure.
The U.S. National Security Agency (NSA) has urged organizations to install updates as soon as possible. If timely fixes are not feasible, vulnerable systems should be taken offline temporarily, as the vulnerabilities may allow attackers to access server file systems or databases and potentially take control of servers without passwords.
Experts say these vulnerabilities are especially serious because PHP is widely used, and some organizations might not even be aware that their systems or services include PHP components behind the scenes.
Calif, a cybersecurity company, discovered the vulnerabilities in August using OpenAI’s AI model to analyze PHP code under a security review project funded by OpenAI. Wiz later independently found the same vulnerabilities, aided by AI models including Google’s Gemini and OpenAI’s models.
OpenAI stated that this discovery is among the most impactful security issues recently and highlights AI’s capability to identify software flaws that could broadly affect internet systems.
The vulnerabilities were reported confidentially to PHP developers in advance to allow preparation for fixes before public disclosure. However, details leaked online on Tuesday before the patch release, forcing many organizations to quickly shut down websites to avoid attacks.
The PHP Foundation, which supports PHP development, released the fix on Wednesday and urged system administrators using PHP to update immediately.
In France, several local government websites, including the Paris police website, were taken offline at the request of the national cybersecurity agency. Finland also temporarily suspended public government websites.
In the Netherlands, the digital identity verification service DigiD, the parliament website, and the national cybersecurity agency’s site were temporarily taken offline to mitigate risks. Meanwhile, Australia’s signals and intelligence agency reported that the government website cyber.gov.au is among the affected sites.
The Wikimedia Foundation, which manages the online encyclopedia Wikipedia, said it has disabled some support systems as a precaution until patches can be safely installed, resulting in some users being unable to access certain services.
Websites for Edinburgh City Council in Scotland and some BBC television programs such as Doctor Who and The Traitors have also been inaccessible. However, it remains unconfirmed whether these outages are directly related to the PHP vulnerabilities.
Additionally, several Pokémon game applications, including Pokémon HOME, Pokémon Champions, and Pokémon Sleep, have suspended services for emergency maintenance, while Japanese game provider Umamusume is working to fix PHP vulnerabilities on its servers.
Cybersecurity experts warn that the key challenge is not just installing patches but also identifying every system that uses PHP, including websites, content management systems, hosting platforms, and third-party software.
Don Smith, a specialist from Sophos’s threat response unit, said this vulnerability is likely to be a prime target for hackers and advised organizations to check if attackers may have already accessed their systems.
Den Kenesh, Chief Technology Officer at Cloudflare, an internet infrastructure provider, said early-stage attacks have been detected, and the company is adjusting defenses according to emerging attack patterns.
The European Union’s cybersecurity agency noted that the vulnerability risk level indicates attackers could execute remote code without authentication, potentially leading to malware installation or website outages.
The United Kingdom’s National Cyber Security Centre (NCSC) recommended administrators continuously monitor updates from third-party software developers, including devices and services that incorporate PHP.
Regarding the impact scope, the European Union’s Computer Emergency Response Team (CERT-EU) said the vulnerabilities may affect PHP versions from 5, launched in 2004, onwards. However, the PHP Foundation’s patches only support certain newer versions; users of PHP 8.1 or older are advised to upgrade to supported versions.
This incident reflects new cybersecurity challenges where AI accelerates the discovery of widely impactful vulnerabilities. Meanwhile, organizations must urgently review and fix systems before malicious actors exploit the flaws.