Key Takeaways
- Critical PHP vulnerabilities discovered using AI led to widespread website outages.
- Developers released urgent updates, but hackers may exploit the flaws.
- Cybersecurity agencies advised users to update or take sites offline.
Government websites in Europe and elsewhere went offline on Wednesday after the disclosure of critical vulnerabilities in the widely used PHP programming language. Developers of PHP released urgent new fixes, urging all users to update immediately.
With tech firms warning that some hackers were already exploiting the flaws, government agencies across Europe took sites offline as a precaution. Experts are bracing for a wave of intrusions as hackers jump to get ahead of the fixes.
PHP, a language that dates back to the early 1990s, underpins huge parts of the public-facing web and is baked into WordPress, Drupal, Joomla, and Magento sites. Any critical vulnerability in PHP could have enormous knock-on consequences.
The flaw in PHP was discovered using artificial intelligence, according to Alphabet-owned cybersecurity company Wiz. The vulnerabilities remained hidden in the PHP codebase for more than a decade and would have been extraordinarily complicated for a human hacker to have taken advantage of.
Cybersecurity agencies in Europe, Australia, Japan, and Britain have urged PHP users to update immediately or take websites offline until patches can be applied. The Dutch cybersecurity agency itself went offline as a precaution.
The operator of the online encyclopedia Wikipedia also said it had taken down an unspecified number of systems until they could be safely patched. Even some world leaders, who don’t typically get involved with software updates, weighed in. Japanese Prime Minister Sanae Takaichi advised website owners to check whether their live sites use PHP and prepare to apply the new fix.
Wiz said its research relied on Wiz Atlas, its autonomous AI vulnerability research tool, as well as Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol. The company said it coordinated with the PHP team, OpenAI, and the cybersecurity company Calif on the discovery of the vulnerability and patch verification.
The operator of the online encyclopedia Wikipedia also said it had taken down an unspecified number of systems until they could be safely patched. Even some world leaders, who don’t typically get involved with software updates, weighed in. Japanese Prime Minister Sanae Takaichi advised website owners to check whether their live sites use PHP and prepare to apply the new fix.
