TWO critical security vulnerabilities in PHP, software underpinning about 75% of websites whose programming language can be identified, have triggered a global cyber alert, forcing government agencies and other organisations to take affected websites offline as hackers attempt to exploit the flaws.
The PHP development team released emergency updates on Wednesday, urging users to patch their systems immediately, while cybersecurity agencies worldwide advised organisations unable to apply the fixes promptly to shut down vulnerable sites temporarily.
Reuters reported today that the flaws, which had remained hidden in the codebase for more than a decade, were discovered using artificial intelligence (AI)-assisted security tools, according to cybersecurity firms Calif and Wiz.
Experts warned that the public release of patches could accelerate attempts to exploit unpatched systems, as attackers use AI tools to identify and reproduce vulnerabilities more quickly.
“AI is powering a ‘race to exploit’,” said Costin Raiu, co-founder of cybersecurity research and incident response firm TLP, warning that the next stage could involve widespread compromise of vulnerable web servers.
Tiffany Farriss, interim chief executive of the Drupal Association, said the issue affected a broad range of systems.
“All servers using any version of PHP released in the last 20 years will be vulnerable,” she said. “This issue impacts the majority of the internet.”
Data from internet intelligence firm Censys showed that about 1.5 million of 2.6 million hosts reported running PHP versions for which no fix was available.
The Netherlands, France, Denmark and Finland were among the countries that took precautionary action.
In the Netherlands, the National Cyber Security Centre and several other organisations took public-facing websites offline, including the Port of Rotterdam, government portal Overheid.nl, the national football association KNVB, websites belonging to the country’s five largest political parties and several hospital websites.
Danish municipal IT company Kombit shut down several services, including the national school communication platform, while Finland’s state IT services provider Valtori took government public network services offline as a precaution.
France’s Interior Ministry placed all its websites under preventive maintenance.
The Dutch cybersecurity agency also took its own website offline, while the operator of Wikipedia said it had temporarily taken down an unspecified number of systems pending security updates. The Internet Archive said it had also briefly gone offline to address the issue.
The vulnerabilities were independently identified by Calif and Wiz. Calif said it discovered the flaws with the help of a large language model on Aug 1 and had been working on a fix. Wiz said its research used its autonomous AI vulnerability research tool, Wiz Atlas, alongside Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol.
Both companies said they coordinated with each other, the PHP development team and OpenAI on the discovery.
Amazon’s security chief CJ Moses said the company had detected an attempted exploitation of the vulnerabilities against one of its decoy systems, known as a honeypot, on Oct 17 — four days before public disclosure.
The attempt came from an anonymous internet address, and it remained unclear how the actor had learned about the flaws while details were under embargo. Amazon said further attempts by multiple actors were detected on Wednesday and described the vulnerabilities as being widely exploited in the wild, although it was unclear whether the attempts would have succeeded against real websites.
The White House said it had been informed of the vulnerability on Friday.
PHP is a free, open-source programming language used by web servers to generate website content. It is embedded in widely used platforms and content management systems, including WordPress, Drupal, Joomla and Magento.
Security experts warned that smaller website operators could face greater risks because they may lack the technical resources to apply patches quickly, particularly when using shared hosting services.
WordPress.com operator Automattic said users of its hosted services and Tumblr were not affected by the bug.
Dutch Prime Minister said he was closely monitoring the situation, while Japanese Prime Minister Sanae Takaichi urged website owners to check whether their live sites used PHP and prepare to install the security updates. - October 22, 2026