Governments and cybersecurity agencies in several countries have urged website operators to take immediate protective measures after two serious security vulnerabilities were discovered in PHP, a widely used programming language that powers a significant portion of the internet. The vulnerabilities prompted several organisations to temporarily take some of their online services offline while security updates were prepared and applied.
According to Reports, A security fix for the vulnerabilities was released on Wednesday afternoon, following warnings that the flaws could expose vulnerable systems to serious cyberattacks. Cybersecurity agencies advised organisations that could not immediately install the necessary updates to consider temporarily shutting down their websites to reduce the risk of exploitation.
Among the organisations that temporarily took some of their online services offline were the Finnish government, Edinburgh City Council and the BBC. The Netherlands’ national cybersecurity agency also announced that its website had been taken offline as a precaution while the vulnerabilities were addressed.
The US National Security Agency (NSA) similarly advised organisations unable to apply the security updates immediately to consider temporarily shutting down affected systems. According to the agency, the vulnerabilities could potentially provide attackers with direct access to server file systems or databases, depending on the configuration and exposure of the affected systems.
The security flaws were discovered with the assistance of artificial intelligence (AI), highlighting the growing role of advanced AI tools in identifying previously undetected weaknesses in widely used software.
Cybersecurity company Wiz described the vulnerabilities as among the most serious flaws discovered by AI so far. The research was conducted by cybersecurity experts at Wiz and Calif, reportedly as part of OpenAI’s Patch the Planet programme, which provides researchers with advanced AI tools to identify and fix vulnerabilities in web development technologies.
OpenAI described the discovery in a blog post as one of the most significant security issues in recent years. Reports indicated that the vulnerabilities had remained undetected for more than a decade before researchers identified them within weeks of using modern AI tools.
Wiz warned that a large number of websites using PHP could potentially be affected. The company estimated that approximately 70 per cent of the internet could fall within the vulnerabilities’ potential sphere of impact in some form, although this does not mean that 70 per cent of websites were compromised or taken offline.
The situation escalated after information about the vulnerabilities was reportedly leaked on social media on Tuesday, prompting an urgent response. The PHP Foundation had initially planned to publish further technical details and a complete security patch later in October, but the leak increased the pressure on organisations to secure vulnerable systems immediately.
Several major online platforms also took precautionary action. The Wikimedia Foundation, which operates Wikipedia, said it was working to address the vulnerabilities and had temporarily shut down several additional systems until they could be safely updated. Some users experienced difficulties accessing parts of Wikipedia on Wednesday.
The BBC also temporarily made some programme-related websites unavailable, including pages associated with Doctor Who and The Traitors. Edinburgh City Council’s website was affected as well. However, the organisations had not confirmed whether their service disruptions were directly caused by the PHP vulnerabilities.
Other websites, including the digital art platform DeviantArt, displayed temporary maintenance notices without publicly specifying the reasons for the interruptions.
Japan’s Prime Minister Sanae Takaichi also urged individuals and organisations to check whether their public-facing websites were running on PHP and to take appropriate precautions if necessary.
Meanwhile, the White House said federal agencies were working with leading AI companies to accelerate efforts to address the problem.
Cybersecurity experts have warned that the incident demonstrates how vulnerabilities in widely used software can create risks across multiple sectors, including government services, healthcare, education and online platforms. They have stressed that organisations should identify potentially affected systems, install verified security updates as soon as possible, review server configurations and monitor for signs of unauthorised access.
Experts also cautioned that temporarily taking a website offline does not necessarily indicate that it has been hacked. In many cases, organisations may suspend services as a precaution while applying security fixes and assessing potential exposure.
The incident has renewed attention on the growing use of AI in cybersecurity, both as a tool for discovering hidden software vulnerabilities and as a means of helping developers and security teams respond more quickly to emerging threats.
