October 21 (Albania Journal) – Government websites in Europe and other regions went offline on Wednesday after critical vulnerabilities were discovered in PHP, a widely used programming language that powers a large part of the internet. The disclosure prompted website operators worldwide to take urgent steps to protect their systems.
PHP developers released emergency security updates on Wednesday to fix vulnerabilities that had remained hidden in the software for years. The flaws were discovered with the help of artificial intelligence (AI), and developers urged users to install the updates immediately.
With technology companies warning that hackers were already exploiting the vulnerabilities, several government agencies and organisations temporarily shut down their websites as a precaution.
Cybersecurity experts warned that the public release of the fixes, combined with AI tools capable of analysing the flaws, could trigger a wave of cyberattacks as hackers race to exploit unpatched systems.
AI was powering a “race to exploit,” said Costin Raiu, co-founder of cybersecurity research and incident response firm TLP:Black. He warned that the next stage could involve the “mass compromise of every vulnerable web server on the internet.”
PHP, which dates back to the early 1990s and initially stood for “Personal Home Page,” supports a significant portion of the internet. It is widely used by platforms and content management systems such as WordPress, Drupal, Joomla and Magento, raising concerns about the potential impact of the vulnerabilities.
“All servers using any version of PHP released in the last 20 years will be vulnerable,” said Tiffany Farriss, interim chief executive of the Drupal Association. “This issue impacts the majority of the Internet.”
Cybersecurity agencies worldwide urged PHP users to update their software immediately or take their websites offline until the necessary patches could be installed.
According to internet intelligence firm Censys, around 1.5 million of the 2.6 million hosts it identified were running PHP versions for which no fix was available.
The Dutch National Cyber Security Centre temporarily took its website offline as a precaution. Wikimedia Foundation, which operates Wikipedia, also said it had taken an unspecified number of systems offline until they could be safely patched. The Internet Archive, a major online library, briefly went offline to address the issue.
The incident also drew attention from political leaders. The Dutch prime minister said he was closely monitoring the situation, while Japanese Prime Minister Sanae Takaichi urged website owners to “check whether your live site uses PHP and prepare to apply the new fix.”
AI HELPED DISCOVER LONG-HIDDEN FLAWS
Two cybersecurity companies independently reported that artificial intelligence had helped uncover the PHP vulnerabilities.
Cybersecurity firm Calif said in a blog post that it discovered the flaws on August 1 with the assistance of a large language model and had been working on a fix since then.
Wiz, a cybersecurity company owned by Alphabet, said it also identified the vulnerabilities using its autonomous AI research tool, Wiz Atlas, alongside Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol.
According to Wiz, the vulnerabilities had remained hidden in PHP’s codebase for more than a decade. Exploiting them would have required an exceptionally complex process for a human hacker.
“Pre-AI, this manual work would be difficult to implement and even harder to scale,” the company said. “With AI, this is no longer a barrier.”
Calif and Wiz said they coordinated their findings with each other, the PHP development team and OpenAI.
The White House said it had been informed of the vulnerability on Friday.
“This discovery demonstrates exactly why American leadership in SI is so critical,” the White House said, referring to President Donald Trump’s preferred term for artificial intelligence. “This is American innovation strengthening our national security.”
WIDESPREAD USE OF PHP RAISES CONCERNS
PHP is a programming language used to build and operate websites. When a visitor opens a webpage, a server running PHP processes the necessary content and sends it to the visitor’s browser. The software is free, open-source and maintained by a community of developers.
Its widespread use has raised concerns among cybersecurity experts. According to web technology tracker W3Techs, PHP powers roughly 75% of websites whose programming language can be identified.
Lukasz Olejnik, a visiting senior research fellow at King’s College London, warned that AI-assisted hacking campaigns could cause extensive damage to servers that had not installed the security updates.
“The scale is huge, and with AI exploitation may happen instantly,” Olejnik said.
Automattic, the company behind WordPress.com, said users of its hosted services and Tumblr were protected from the vulnerability.
However, smaller websites operated by individuals or organisations with limited technical resources could face greater risks. Many such websites rely on shared hosting services, where customers have limited control over the underlying servers and may depend on hosting providers to apply security patches.
GOVERNMENT AND PUBLIC SERVICES FACE DISRUPTION
The Netherlands was among the countries experiencing widespread disruption. Several organisations followed the National Cyber Security Centre’s decision to take public-facing websites offline.
Affected services included the Port of Rotterdam, the government portal Overheid.nl, the Dutch football association KNVB, websites belonging to the country’s five largest political parties and several hospital websites.
In Denmark, municipal IT company Kombit shut down several services, including the national school communication platform.
Disruptions were also reported across Finland. State IT services provider Valtori said government public network services had been taken offline “as a precautionary measure.”
France’s Interior Ministry also placed all its websites into preventive maintenance as authorities and website operators worked to address the security risks.
