Websites operated by governments and major institutions across Europe and beyond were taken offline after critical flaws were found in PHP, a programming language used across much of the internet, prompting administrators worldwide to race to secure their systems.
PHP developers issued emergency security updates for vulnerabilities that had remained hidden in the software for years before being identified with the help of artificial intelligence. They said all users were “encouraged to update immediately”.
- Advertisement -
Technology companies warned that some attackers might already be exploiting the weaknesses, leading government agencies in several European countries to disable public-facing sites as a precaution.
With patches now available and AI tools capable of reverse-engineering the defects quickly, cybersecurity specialists said they expected hackers to move rapidly, potentially launching attacks before organisations could complete their updates.
He said the next step was the “mass compromise of every vulnerable web server on the internet”.
PHP, a language developed in the early 1990s that originally stood for “Personal Home Page”, powers large sections of the public web. It is built into platforms including WordPress, Drupal, Joomla and Magento, giving any serious vulnerability the potential to cause widespread disruption.
“All servers using any version of PHP released in the last 20 years will be vulnerable,” said interim chief executive of the Drupal Association Tiffany Farriss. “This issue impacts the majority of the Internet.”
Cybersecurity authorities in Europe, Australia, Japan and Britain advised PHP users to install the fixes immediately or take websites offline until the patches could be applied.
The Dutch cybersecurity agency also shut down its own website, saying the move was precautionary. The operator of the online encyclopedia Wikipedia said it had disabled an unspecified number of systems while they were prepared for safe patching.
The warnings reached the highest levels of government, with even some world leaders commenting on the need for urgent software updates.
Japanese Prime Minister Sanae Takaichi wrote on X that website owners should “check whether your live site uses PHP and prepare to apply the new fix”.
Watch: Cybersecurity expert says hackers could potentially steal data over software issue
Hackers could steal data from vulnerable websites, expert says
Cybersecurity expert Brian Honan said criminals could potentially take data from vulnerable websites running the “popular” PHP programming language.
Mr Honan said the scale of the threat reflected “the sheer amount of websites that use this software”.
He said PHP is used by 70% of websites around the world.
Speaking on RTÉ’s Six One, Mr Honan said: “There are two security bugs in the software that will enable attackers, be they criminals or hackers … to remotely take over a vulnerable website and do what they want.”
That could allow attackers to steal information or alter the site, he said. “Until the website owners update their software, these websites are vulnerable to attack,” he added.
The security update is available, Mr Honan said, although many website operators will need to test it to ensure the fix does not create additional problems.
“Criminals and hackers will take that patch and reverse engineer the patch to try and identify what the weakness is to enable them to attack the website,” he said.Mr Honan added that companies needed to update their websites as quickly as possible.
Bug found using AI
The PHP flaw was identified with artificial intelligence, according to a blog post from Alphabet-owned GOOGL.O cybersecurity firm Wiz.
Wiz said the vulnerabilities had been concealed in PHP’s codebase for more than a decade and would have been exceptionally difficult for a human attacker to exploit.
“Pre-AI, this manual work would be difficult to implement and even harder to scale,” it said. “With AI this is no longer a barrier.”
The research used Wiz Atlas, the company’s autonomous AI vulnerability research tool, along with Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol, Wiz said.
Wiz said it worked with the PHP team, OpenAI and cybersecurity company Calif to identify the vulnerability and verify the patch.
The company also said it collaborated with Google Cloud, Cloudflare NET.N, Amazon’s AMZN.O AWS, Microsoft MSFT.O, WordPress.com operator Automattic, and firms including Fastly FSLY.O, Akamai AKAM.O, Imperva and Vercel to help protect customers and prepare mitigations.
The White House said in a statement that it had been informed of the flaw on Friday.
“This discovery demonstrates exactly why American leadership in SI is so critical,” the White House said, referring to US President Donald Trump’s preferred term for artificial intelligence.
“This is American innovation strengthening our national security.”
Critical software used to run websites
PHP is a programming language that helps operate websites.
When someone opens a web page, a server running PHP builds the requested content and delivers it to the browser. The software is free, open source and maintained by volunteers.
PHP’s widespread use – it operates roughly 75% of websites whose programming language can be identified, according to web technology tracker W3Techs – combined with the seriousness of the vulnerabilities has left experts concerned about the sheer number of exposed systems.
Lukasz Olejnik, a visiting senior research fellow at King’s College London, said the growing use of AI-assisted hacking campaigns could intensify the threat.
“The scale is huge, and with AI exploitation may happen instantly, on a large scale,” Mr Olejnik said.
The danger is especially pronounced for small websites run by individuals or organisations with limited technical capacity. Many rely on shared hosting services and do not control the underlying servers directly.
Security experts warned that those sites may be slower to patch, leaving them exposed even after fixes have been released.
Mass outages across Europe
In the Netherlands, a number of organisations followed the National Cyber Security Centre’s lead by taking public websites offline. Those affected included the Port of Rotterdam, government portal Overheid.nl, national soccer association KNVB, the websites of the country’s five largest political parties and several hospital sites.
Danish municipal IT company Kombit said it had suspended several services, including the country’s national school communication platform.
The disruption spread further in Finland, where state IT provider Valtori said public government network services had been taken offline “as a precautionary measure”.
France’s Interior Ministry said all of its websites had been placed in preventive maintenance.
Japanese cloud provider Sakura Internet said it had suspended a database appliance function.
