PHP Flaws Found With AI Force Websites Offline Across Several Countries

Government agencies and companies in several countries took websites offline on Wednesday after two critical security flaws surfaced in PHP, a programming language behind around 70% of the world's websites, according to Euronews. Developers released emergency fixes the same day.

Cybersecurity authorities told organizations to update affected systems immediately or disconnect them until they could be secured. Some public-service pages and supporting online services may therefore have been temporarily unavailable.

What are the PHP flaws and how serious are they?

Two vulnerabilities were reported in PHP, a widely used language that helps run websites. The PHP security team gave both a severity rating of 9.2 out of 10, Euronews reported. The outlet did not describe the technical details of the flaws.

Details were supposed to stay confidential while developers prepared fixes. Information about the problems became public before the planned release, which increased pressure on system operators to apply updates quickly.

How were the vulnerabilities discovered?

Artificial intelligence played a role. The security firm Calif found one of the flaws in August during an audit of PHP funded by OpenAI. OpenAI said its GPT-5.6 Sol model was used in that research.

Wiz, a cybersecurity company owned by Google, separately found and reported both vulnerabilities, according to Euronews.

Which websites and services were taken offline?

The Wikimedia Foundation, which operates Wikipedia, said it deliberately shut down a number of supporting services while it installed security updates. It warned users that some disruption could occur.

Several European governments also acted as a precaution:

• France's Interior Ministry temporarily took prefecture websites offline while updates were applied.
• Germany's federal IT provider, ITZBund, shut down several government websites. German officials called the step precautionary and said no security incidents had been identified.
• Government and public-service websites in the Netherlands and Finland were also taken offline while authorities secured their systems.

In the United Kingdom, the National Cyber Security Centre urged organizations running PHP to find vulnerable systems, watch them for suspicious activity and install updates as soon as possible.

Are attackers exploiting the flaws?

Early signs pointed to limited abuse. Security researchers initially reported little evidence of widespread exploitation before the flaws became public. Attempted attacks have since been detected, which has raised concern that systems left unpatched could be targeted.

Amazon Threat Intelligence said it detected attempts to exploit the vulnerabilities, including some activity before the public disclosure. Researchers have also reported attempts against vulnerable systems in the wild.

Why does it matter for ordinary internet users?

Because PHP underpins so many sites, a flaw of this severity can affect services people use every day, from reference sites to government portals. The immediate effect for most users is likely to be temporary outages or limited functions on sites whose operators chose to pause service while patching.

The episode also shows how AI tools are now being used to uncover serious software weaknesses. In this case, AI-assisted research helped find flaws in code that supports a large share of the web. The early public leak of the details shortened the time operators had to prepare.

What happens next?

Fixes are available, and authorities are asking organizations to apply them. How quickly affected sites return to normal depends on how fast operators install the updates and confirm their systems are secure. Euronews did not report a timeline for restoring the sites that were taken offline.

Around Prague, based on reporting by Euronews