Representative image (REUTERS photo)
Cybersecurity experts warned that hackers could exploit the flaws on a large scale as website operators scrambled to install emergency fixes. Several technology firms warned that attackers were already attempting to exploit the vulnerabilities, prompting government agencies and other organisations to temporarily take websites offline as a precaution. Government websites and online services across Europe and elsewhere went offline on Wednesday after critical vulnerabilities in the widely used PHP programming language triggered a global security response, Reuters reported. PHP developers released security patches on Wednesday, urging users to update immediately.
You use AI every day. Now get your AI Quotient. Take the AIQ test.
The disruption has underscored the risks posed by security flaws in widely used software, with experts warning that AI could accelerate the process of turning previously difficult-to-exploit vulnerabilities into tools for large-scale cyberattacks.
Calif said it identified the flaws with the help of a large language model on August 1, while Alphabet-owned Wiz said its research involved its autonomous AI vulnerability research tool, Wiz Atlas, as well as Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol. Amazon’s security chief, CJ Moses, said the company’s security team detected an attempt to exploit the flaws against one of its decoy systems on October 17, four days before public disclosure. PHP runs roughly 75% of websites whose programming language can be identified, according to web technology tracker W3Techs. Data from internet intelligence firm Censys showed that about 1.5 million of the 2.6 million hosts it tracked were running PHP versions for which no fix was available.
AI was powering a “race to exploit,” said Costin Raiu, co-founder of cybersecurity research and incident response firm TLP. Two cybersecurity companies, Calif and Wiz, said they had independently discovered the vulnerabilities using artificial intelligence. The vulnerabilities had remained hidden in PHP’s codebase for more than a decade and would have been exceptionally difficult for human hackers to exploit at scale, according to Wiz. “Pre-AI, this manual work would be difficult to implement and even harder to scale,” the company said in a blog post. Calif and Wiz said they coordinated with each other, the PHP development team and OpenAI on the discovery. “This issue impacts the majority of the internet,” said Tiffany Farriss, interim chief executive of the Drupal Association. “All servers using any version of PHP released in the last 20 years will be vulnerable,” she said. “The scale is huge, and with AI, exploitation may happen instantly,” Olejnik said. In Finland, state IT services provider Valtori took government public network services offline “as a precautionary measure”. The operator of Wikipedia said it had taken an unspecified number of systems offline until they could be safely patched. Dutch Prime Minister said he was closely monitoring the situation, while Japanese Prime Minister Sanae Takaichi urged website owners to “check whether your live site uses PHP and prepare to apply the new fix.”
With fixes now publicly available, experts warned that artificial intelligence tools could help hackers reverse-engineer the vulnerabilities and target unpatched systems before operators could secure them. He warned that the next stage could be the “mass compromise of every vulnerable web server on the internet. “With AI, this is no longer a barrier. The attempt came from an anonymous internet address, and it remained unclear how the attacker had learned about the vulnerabilities while details were under embargo. It added that it was unclear whether the attempts would have succeeded against real websites. PHP is a programming language used to run websites and is built into widely used platforms such as WordPress, Drupal, Joomla and Magento. Cybersecurity agencies urged website operators to apply the patches immediately or take their websites offline until the fixes could be installed. Experts warned that smaller websites run by individuals and organisations with limited technical resources could face greater risks, particularly those using shared hosting services. Lukasz Olejnik, a visiting senior research fellow at King’s College London, warned that AI-assisted hacking campaigns could cause widespread disruption if vulnerable servers remained unpatched. The vulnerabilities triggered precautionary shutdowns across several European countries. In the Netherlands, the National Cyber Security Centre went offline, followed by several other organisations, including the Port of Rotterdam, government portal Overheid.nl, the national football association KNVB, websites of the country’s five largest political parties and several hospital websites. Danish municipal IT company Kombit shut down several services, including the national school communication platform. France’s Interior Ministry also placed all its websites under preventive maintenance. The Internet Archive also briefly went offline to address the issue.
The White House said it had been informed of the vulnerability on Friday. Amazon said multiple actors made further attempts on Wednesday and warned that the flaws were “now being broadly exploited in the wild.
Automattic, which operates WordPress.com, said users of its hosted services and Tumblr were protected from the vulnerability.