Websites across several countries have been taken offline as governments and cybersecurity agencies respond to two critical vulnerabilities discovered in PHP, a programming language widely used to power websites and online services.
The flaws were identified by cybersecurity researchers using advanced artificial intelligence (AI) tools, prompting an urgent security update released on Wednesday afternoon. Authorities have advised organisations to install the patches immediately or temporarily shut down affected systems if they cannot secure them in time.
Among the organisations affected are Finland’s government, Edinburgh City Council, the Wikimedia Foundation and several BBC programme websites, including pages associated with Doctor Who and The Traitors. The Netherlands has also taken precautionary measures, with its cybersecurity agency and other government bodies making their websites temporarily inaccessible.
The US National Security Agency issued similar guidance, warning organisations to take vulnerable systems offline if they could not apply the necessary updates. The White House also confirmed that federal agencies were working with leading AI laboratories to accelerate efforts to address the security threat.
Japan’s Prime Minister, Sanae Takaichi, urged organisations to check whether their publicly accessible websites run on PHP and ensure they take appropriate action.
The Wikimedia Foundation, which operates Wikipedia, said it was working to address the vulnerabilities and had taken several additional systems offline as a precaution. The measures temporarily prevented some users from accessing parts of the online encyclopedia.
AI Helps Uncover Decade-Old Vulnerabilities
The vulnerabilities were discovered by cybersecurity researchers at Calif and Wiz, who used advanced AI models developed by OpenAI to identify the flaws.
Wiz described the discoveries as among the most serious vulnerabilities identified with AI assistance, while OpenAI called the issue one of the most significant cybersecurity problems in recent memory.
According to the researchers, the flaws had remained undetected for more than a decade. Wiz said advanced AI models made it possible to develop and adapt working exploits across multiple applications within hours.
The company estimates that approximately 70 per cent of the internet could be affected, although that figure has not been independently verified.
Several other websites have also reported disruptions. Online art platform DeviantArt, for example, displayed a temporary maintenance notice without explicitly confirming whether the PHP vulnerabilities were responsible.
In the Netherlands, the National Institute for Public Health and the Environment and the website of the Tweede Kamer, the country’s lower parliamentary chamber, were also taken offline.
Agencies Urge Immediate Security Updates
Cybersecurity authorities in the United Kingdom, European Union, Australia and Japan have urged organisations using PHP to install the available security fixes.
The UK’s National Cyber Security Centre (NCSC) advised organisations to take affected systems offline if immediate remediation was not possible, keeping them unavailable until the vulnerabilities could be adequately addressed.
The European Union Computer Emergency Response Team, known as CERT-EU, warned that the vulnerabilities could potentially allow unauthenticated remote code execution. This type of attack can enable hackers to run malicious code on vulnerable systems without first logging in.
Successful exploitation could allow attackers to install malware, access sensitive information or disrupt online services.
The precise scope of affected PHP versions remains uncertain. CERT-EU warned that the vulnerabilities could extend to versions dating back to PHP 5, released in 2004.
However, the PHP Foundation has issued fixes for the latest versions of the language. Organisations running PHP 8.1 or older have been advised to upgrade to a supported version rather than rely on unavailable security patches.
Widespread Use of PHP Complicates the Response
PHP remains a fundamental part of the internet’s infrastructure. It is used by popular content management systems and e-commerce platforms, including WordPress, Drupal, Joomla and Magento, as well as hosting services and other software products.
Cybersecurity company Huntress noted that PHP frequently operates behind the scenes, meaning organisations may be running it without realising it.
Don Smith of the Sophos Counter Threat Unit told the BBC that the vulnerabilities would likely become a priority target for cybercriminals.
He explained that organisations face a challenge beyond installing the patches: they must identify every instance of PHP running across their websites, hosting environments, content management systems and third-party applications.
Smith also stressed the importance of investigating whether attackers had already gained access to vulnerable systems before the security updates became available.
Meanwhile, Cloudflare Chief Technology Officer Dane Knecht said the company was already observing early attacks and updating its protective measures as new attack methods emerged.
The NCSC has advised organisations to continue monitoring security updates from third-party software providers, particularly where PHP is included in appliances, applications or managed services.
Websites taken offline as a precaution are expected to return once the necessary updates have been installed and their systems have been checked for security risks.
The incident highlights the growing role of AI in cybersecurity. Although advanced AI tools helped researchers identify vulnerabilities that had gone unnoticed for years, the discoveries also demonstrate how quickly sophisticated techniques can expose weaknesses in widely used internet infrastructure.
