Developers of the PHP programming language on Wednesday released emergency security updates to address vulnerabilities that had remained undetected in the software for years, urging users to install the fixes immediately.
The security flaws, uncovered with the assistance of artificial intelligence (AI), prompted government agencies and organisations across Europe and other regions to temporarily shut down websites as a precautionary measure.
Technology companies have warned that hackers may already be exploiting the vulnerabilities. With the fixes now publicly available and AI tools capable of helping attackers analyse the flaws, cybersecurity experts fear a surge in cyberattacks targeting unpatched systems.
Costin Raiu, co-founder of cybersecurity research and incident response firm TLP: Black, described the situation as an AI-driven “race to exploit”. He warned that the next phase could involve widespread compromises of vulnerable web servers worldwide.
PHP, a programming language developed in the early 1990s, powers a significant portion of the internet. It is widely used by content management systems and platforms, including WordPress, Drupal, Joomla and Magento, making critical vulnerabilities in the software a potential threat to millions of websites.
Tiffany Farriss, interim chief executive of the Drupal Association, warned that the issue could affect a vast number of online services, stressing that the vulnerabilities posed a serious risk to internet infrastructure.
Cybersecurity agencies in Europe, Australia, Japan and the United Kingdom have urged PHP users to apply the security updates immediately or temporarily take their websites offline until the necessary patches are installed.
The Dutch National Cyber Security Centre temporarily took its own website offline as a precaution. Wikipedia’s operator also confirmed that an unspecified number of systems had been taken down until they could be securely updated.
Japanese Prime Minister Sanae Takaichi urged website operators to check whether their sites use PHP and prepare to install the latest security fixes.
Cybersecurity company Wiz, owned by Alphabet, said the vulnerabilities were identified through AI-assisted security research.
According to the company, the flaws had remained hidden in PHP’s codebase for more than a decade and would have been difficult for human researchers to discover and exploit at scale using traditional methods.
Wiz said advances in AI have significantly reduced the effort required to identify and analyse such vulnerabilities, potentially allowing attackers to exploit weaknesses much faster.
The company said its research involved Wiz Atlas, its autonomous AI vulnerability research tool, alongside Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol. Wiz also said it coordinated with the PHP development team, OpenAI and cybersecurity company Calif during the discovery and verification of the fixes.
To strengthen protection for customers, Wiz worked with Google Cloud, Cloudflare, Amazon Web Services, Microsoft, Automattic, Fastly, Akamai, Imperva and Vercel on mitigation measures.
The White House said it had been informed about the vulnerability on Friday, describing the discovery as an example of American technological innovation strengthening national security.
PHP is free, open-source software maintained by a community of developers. It processes website requests on servers, generating content that is then delivered to users’ browsers.
According to web technology tracker W3Techs, PHP is used by approximately 75 per cent of websites for which the server-side programming language is known.
Its widespread adoption has heightened concerns about the potential scale of the threat, particularly if attackers begin targeting systems that have not yet installed the available patches.
Lukasz Olejnik, a visiting senior research fellow at King’s College London, warned that AI-assisted cyberattacks could accelerate both the speed and scale of exploitation.
The risks are particularly significant for smaller websites operated by individuals and organisations with limited technical resources. Websites hosted on shared servers may also remain vulnerable because their operators often have limited control over the underlying infrastructure.
Cybersecurity specialists warn that delays in applying security updates could leave vulnerable systems exposed even after fixes have been released.
The security alert triggered precautionary shutdowns across several countries as organisations moved to protect their systems.
In the Netherlands, affected websites included the Port of Rotterdam, the government portal Overheid.nl, the national football association KNVB, websites belonging to the country’s five largest political parties and several hospital websites.
Danish municipal IT company Kombit also suspended several services, including the national school communication platform.
In Finland, state IT services provider Valtori took government public network services offline as a precautionary measure.
France’s Interior Ministry placed all its websites under preventive maintenance, while Japanese cloud service provider Sakura Internet announced the suspension of a database appliance function.
The developments highlight the growing cybersecurity challenges associated with widely used software and the dual role of AI in identifying security weaknesses and potentially enabling their exploitation.
Security experts have urged website operators to assess their exposure, install the latest PHP security updates and follow official guidance to reduce the risk of unauthorised access and further disruptions.
