Government websites across Europe and other parts of the world went offline on Wednesday after critical security flaws discovered using artificial intelligence prompted an urgent effort to protect systems from potential cyberattacks.
Developers of PHP, one of the world’s most widely used programming languages, released emergency fixes on October 21 after vulnerabilities that had remained undetected for years were uncovered using AI.
The developers encouraged all users to update immediately, as technology companies warned that hackers had already begun exploiting some of the flaws.
Government agencies across Europe took websites offline as a precaution, while cybersecurity experts warned that the public release of the fixes could help attackers identify and exploit systems that had not yet been updated.
Costin Raiu, co-founder of cybersecurity research and incident response firm TLP, described the situation as an AI-powered race to exploit.
He warned that the next stage could involve the mass compromise of every vulnerable web server on the internet.
PHP is used to run large parts of the public-facing internet, including websites built with WordPress, Drupal, Joomla and Magento.
The programming language, which dates back to the early 1990s and originally stood for Personal Home Page, processes website content on servers before sending it to visitors’ browsers.
According to web technology tracker W3Techs, PHP powers roughly 75% of websites whose programming language can be identified.
Tiffany Farriss, interim chief executive of the Drupal Association, warned that the vulnerabilities affected PHP versions released over the last 20 years. “All servers using any version of PHP released in the last 20 years will be vulnerable. This issue impacts the majority of the Internet.”
Cybersecurity agencies in Europe, Australia, Japan and Britain have advised PHP users to install the fixes immediately or take affected websites offline until updates can be completed.
Japanese Prime Minister Sanae Takaichi also addressed the threat, advising website operators to check whether your live site uses PHP and prepare to apply the new fix.
Cybersecurity company Wiz, owned by Alphabet, said artificial intelligence helped researchers discover the vulnerabilities, which had remained hidden in PHP’s code for more than a decade.
In a blog post, Wiz explained that exploiting the flaws would previously have required exceptionally complex manual work, making such attacks difficult to carry out on a large scale. “Pre-AI, this manual work would be difficult to implement and even harder to scale, the company said. With AI this is no longer a barrier.”
Wiz said its investigation used Wiz Atlas, its autonomous AI vulnerability research tool, alongside Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol.
The company worked with the PHP development team, OpenAI and cybersecurity firm Calif to identify the vulnerabilities and verify the fixes.
It also coordinated with Google Cloud, Cloudflare, Amazon Web Services, Microsoft, Automattic, Fastly, Akamai, Imperva and Vercel to prepare protective measures for customers.
The White House said it had been informed of the vulnerability on Friday. “This discovery demonstrates exactly why American leadership in SI is so critical,” it said, using President Donald Trump’s preferred term for artificial intelligence. This is American innovation strengthening our national security.”
Cybersecurity specialists fear that the combination of widely available vulnerability information and increasingly capable AI tools could allow hackers to attack unpatched websites rapidly.
Lukasz Olejnik, a visiting senior research fellow at King’s College London, warned that the number of potentially affected systems made the threat particularly serious. “The scale is huge, and with AI exploitation may happen instantly, on a large scale.”
Experts identified smaller websites as particularly vulnerable, especially those operated by individuals and organisations with limited technical resources.
Many rely on shared hosting services and do not directly control the servers running their websites. This could delay the installation of security updates and leave them exposed even after fixes become available.
The Netherlands was among the countries affected, with its National Cyber Security Centre taking its own website offline as a precaution.
Several other Dutch organisations followed, including the Port of Rotterdam, government information portal Overheid.nl, national football association KNVB and the websites of the country’s five largest political parties.
In Denmark, municipal IT company Kombit shut down several services, including the country’s national school communication platform.
Finland experienced wider disruption after state IT services provider Valtori announced that government public network services had been taken offline as a precautionary measure.
France’s Interior Ministry placed all its websites into preventive maintenance.
The disruption extended beyond Europe. Japanese cloud provider Sakura Internet suspended a database appliance function on Wednesday.
Wikipedia’s operator also reported taking an unspecified number of systems offline until they could be safely patched.
With security fixes now publicly available, website administrators face pressure to update their systems before attackers can exploit the vulnerabilities.
Erizia Rubyjeana
Follow us on:
