LONDON: Government websites in Europe and elsewhere went offline on Wednesday after the disclosure of critical vulnerabilities in a widely used programming language sent website operators around the world scrambling to protect their systems.
Developers of the PHP programming language on Wednesday released urgent new fixes to vulnerabilities that had quietly been lurking in their software for years until they were uncovered using AI, saying that all users were “encouraged to update immediately.”
With tech firms warning that some hackers were already exploiting the flaws, government agencies across Europe were among those that took sites offline as a precaution.
Because a fix is now public and artificial intelligence tools are able to reverse engineer the bug with little effort, experts said they were bracing for a wave of intrusions as hackers jumped to get ahead of fixes.
AI was powering a “race to exploit,” said Costin Raiu, co-founder of cybersecurity research and incident response firm TLP: Black. He said the next step was the “mass compromise of every vulnerable web server on the internet”.
There’s no shame in taking a website offline while waiting for PHP security patches. https://t.co/5pjr8wZI3m
— Costin Raiu (@craiu) October 21, 2026
PHP, a language that dates back to the early 1990s and initially stood for “Personal Home Page”, underpins huge parts of the public-facing web and is baked into WordPress, Drupal, Joomla and Magento sites, meaning that any critical vulnerability potentially has enormous knock-on consequences.
“All servers using any version of PHP released in the last 20 years will be vulnerable,” said Tiffany Farriss, the interim chief executive of the Drupal Association. “This issue impacts the majority of the Internet.”
Cybersecurity agencies in Europe, Australia, Japan and Britain have urged PHP users to update immediately or take websites offline until patches can be applied.
The Dutch cybersecurity agency itself went offline, saying it had done so as a precaution because of the vulnerabilities. The operator of the online encyclopedia Wikipedia also said it had taken down an unspecified number of systems until they could be safely patched.
Even some world leaders, who don’t typically get involved with software updates, weighed in. Japanese Prime Minister Sanae Takaichi, in a post on X, said website owners should “check whether your live site uses PHP and prepare to apply the new fix.”
皆様に、今夜に対応して頂きたい大至急のお願いです。 多くのウェブサイトで使用されているPHPに関し、PHPのセキュリティチームが、重大な２件の脆弱性に関する注意喚起を行っています。 公開しているウェブサイトでPHPを使用しているか確認し、今夜、10月21日午後11時（日本時間）に公開される修正パッチについて、可及的速やかに適用できるよう準備をお願いします。 修正パッチを速やかに適用することが困難な場合は、例えばウェブサイト等を一時的に停止させることも、リスクを低減させるための有効策の一つと考えられます。 国家サイバー統括室のXアカウントでも関係する情報を発信していますので、そちらも参考にして下さい。 国家サイバー統括室(注意・警戒情報)（@cyber_forecast） / X
— 高市早苗 (@takaichi_sanae) October 21, 2026
Bug found with AI
The flaw in PHP was discovered using artificial intelligence, Alphabet-owned cybersecurity company Wiz said in a blog post.
The vulnerabilities remained hidden in the PHP codebase for more than a decade and would have been extraordinarily complicated for a human hacker to have taken advantage of, the post said.
“Pre-AI, this manual work would be difficult to implement and even harder to scale,” it said. “With AI, this is no longer a barrier.”
AI tools helped find one of the most severe online bugs ever #php2shell In our latest episode of Crying Out Cloud, Amitai Cohen sits down with @sagitz_ (Wiz Research) and Thai Duong (@calif_io) to unpack the massive PHP2Shell vulnerability https://t.co/n4pfiXjDNC
— Wiz (@wiz_io) October 21, 2026
Wiz said its research relied on Wiz Atlas, its autonomous AI vulnerability research tool, as well as Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol. Wiz said it coordinated with the PHP team, OpenAI, and the cybersecurity company Calif on the discovery of the vulnerability and patch verification.
The company said it also partnered with Google Cloud, Cloudflare, Amazon’s AWS, Microsoft, WordPress.com operator Automattic, and other companies such as Fastly, Akamai, Imperva, and Vercel to protect customers and prepare mitigations.
In a statement, the White House said it was made aware of the flaw on Friday.
“This discovery demonstrates exactly why American leadership in SI is so critical,” the White House said, referring to President Donald Trump’s preferred term for artificial intelligence. “This is American innovation strengthening our national security.
Critical software
When a visitor loads a page, a server running PHP assembles the content and sends it to the browser. It is free, open-source software maintained by volunteers.
Because of its ubiquity, PHP runs roughly 75 per cent of websites whose programming language can be identified, according to web technology tracker W3Techs, and because the vulnerabilities are considered so dangerous, experts are anxious about a potentially vast pool of sitting ducks.
AI-assisted hacking campaigns, which have proliferated in recent weeks, would only make things worse, said Lukasz Olejnik, a visiting senior research fellow at King’s College London.
“The scale is huge, and with AI, exploitation may happen instantly, on a large scale,” Olejnik said.
The risk is particularly acute for small websites run by individuals or organisations with limited technical resources, often on shared hosting services where customers do not directly manage the underlying servers. Security experts said such sites could take longer to patch and remain exposed well after fixes become available.
Mass outages
In the Netherlands, several organisations followed the example of the National Cyber Security Centre and took public-facing websites offline, including the Port of Rotterdam, government portal Overheid.nl, the national football association KNVB, the websites for the country’s five largest political parties and several hospital websites.
Danish municipal IT company Kombit said it had shut down several services, including the national school communication platform.
Disruption was even more widespread in Finland, where state IT services provider Valtori said government public network services had been taken offline “as a precautionary measure”.
France’s Interior Ministry said it had placed all of its websites into preventive maintenance. Japanese cloud service provider Sakura Internet said on Wednesday it had suspended a database appliance function.
