Public-facing websites in Europe and elsewhere were taken offline on Wednesday after the disclosure of critical vulnerabilities in PHP, a programming language used across a vast portion of the web. The revelation sent website operators scrambling to secure their systems, while PHP’s maintainers released emergency fixes and urged all users to update immediately.
The flaws had reportedly remained hidden in PHP’s codebase for years before being uncovered with the help of artificial intelligence. Cybersecurity firms warned that some attackers were already attempting to exploit them. With a patch now publicly available—and with AI tools capable of helping reverse-engineer the bug quickly—experts said they expected a wave of intrusions as hackers raced to strike vulnerable systems before they could be secured.
Costin Raiu, co-founder of cybersecurity research and incident response firm TLP:Black, described the situation as an AI-powered “race to exploit” and warned that the next stage could be the mass compromise of vulnerable web servers across the internet.
PHP dates back to the early 1990s and underpins a large share of the public web. It is embedded in widely used platforms including WordPress, Drupal, Joomla and Magento, meaning that a critical flaw can have far-reaching consequences. Tiffany Farriss, interim chief executive of the Drupal Association, said every server running any PHP version released in the past 20 years would be vulnerable, adding that the issue affects the majority of the internet. According to web technology tracker W3Techs, PHP runs roughly 75% of websites whose programming language can be identified.
Cybersecurity agencies in Europe, Australia, Japan and Britain advised PHP users to update immediately or take sites offline until patches could be applied. The Dutch cybersecurity agency took its own site offline as a precaution, and the operator of Wikipedia said it had shut down an unspecified number of systems until they could be safely patched. Japanese Prime Minister Sanae Takaichi also weighed in, posting on X that website owners should check whether their live sites use PHP and prepare to apply the new fix.
Wiz, an Alphabet-owned cybersecurity company, said its researchers discovered the vulnerability using AI. The flaws had gone unnoticed for more than a decade and would have been extraordinarily difficult for a human hacker to exploit manually, according to the company. Wiz said AI removed that barrier. Its research relied on Wiz Atlas, its autonomous AI vulnerability research tool, as well as Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol. Wiz said it coordinated with the PHP team and OpenAI on the discovery and patch verification, and partnered with Google Cloud, Cloudflare, AWS, Microsoft, Automattic, Fastly, Akamai, Imperva, Vercel and other companies to protect customers and prepare mitigations.
The White House said it was informed of the flaw on Friday. It described the discovery as an example of why American leadership in “SI”—President Donald Trump’s preferred term for artificial intelligence—is critical, saying the innovation was strengthening national security.
The disruptions spread across several countries. In the Netherlands, the National Cyber Security Centre and other organizations took public websites offline, including the Port of Rotterdam, government portal Overheid.nl, the national soccer association KNVB, the websites of the country’s five largest political parties and several hospital sites. Danish municipal IT company Kombit shut down several services, including the national school communication platform. In Finland, state IT services provider Valtori said government public network services had been taken offline as a precaution. France’s Interior Ministry placed all of its websites into preventive maintenance, and Japanese cloud service provider Sakura Internet suspended a database appliance function.
Experts said the risk is especially severe for small websites run by individuals or organizations with limited technical resources, particularly those on shared hosting services where customers do not directly manage the underlying servers. Such sites may take longer to patch and could remain exposed well after fixes become available.