Government agencies, online services and companies around the world took websites offline on Wednesday after two critical security vulnerabilities were discovered in PHP, a programming language used by a large share of the internet.
The flaws could affect a wide range of websites, including online retailers, news outlets and government services. Security firm Wiz estimated that PHP underpins about 70 per cent of websites worldwide and described the weaknesses as among the most severe vulnerabilities found in the language.
The US National Security Agency urged organisations to install the available security updates immediately or take vulnerable systems offline. The agency warned that the flaws could provide attackers with a direct route to a server’s file system or database, potentially allowing them to take control of web servers without a password.
Only websites running PHP on their own servers are directly exposed. Many large platforms use other programming languages or were able to apply the necessary fixes quickly, allowing them to remain operational.
Volker Dusch, a security engineer at the PHP Foundation, told The Wall Street Journal that the incident was the most serious security problem faced by PHP in more than a decade. He compared it with Heartbleed, a major vulnerability disclosed in 2014 that triggered a worldwide effort to secure affected systems.
PHP developers released a fix on Wednesday after the weaknesses had been reported privately and details were kept confidential while a patch was prepared.
“If you run PHP, it is imperative that you update now,” the PHP Foundation, which funds developers working on the language, said in a blog post.
The urgency increased after information about the vulnerabilities leaked online on Tuesday, one day before the planned release of the fix. The disclosure prompted organisations to shut down affected services as a precaution against possible attacks.
In France, local government websites, including the Paris police website, were made inaccessible at the request of the French National Cybersecurity Agency, the interior ministry said.
In the Netherlands, the national digital identity service DigiD, the House of Representatives website and the national cybersecurity centre’s website were taken offline, according to public broadcaster NOS.
Australia’s Signals Directorate said its cyber.gov.au website was among the government sites affected, public broadcaster ABC reported.
The Wikimedia Foundation, which operates Wikipedia, warned that users could experience outages while it addressed the vulnerabilities. The organisation said it had deliberately taken many supporting services offline until they could be patched safely.
Several Pokémon applications, including Pokémon HOME, Pokémon Champions and Pokémon Sleep, also underwent emergency maintenance. Gaming news outlet Kotaku reported that Pokémon Sleep cited security measures as the reason for its downtime. The operator of Japanese game Umamusume separately announced maintenance to address a PHP vulnerability affecting its servers.
The discovery also highlighted the growing role of artificial intelligence in cybersecurity research. Security firm Calif found the flaws in August using OpenAI’s GPT-5.6 Sol model during an OpenAI-funded audit of PHP code. Wiz said it independently identified the weaknesses weeks later with assistance from AI models, including Google’s Gemini 4 Argon and GPT-5.6 Sol.
OpenAI called the vulnerabilities among the most impactful in recent memory, saying the findings showed how AI could identify security weaknesses with consequences across the internet.
Ethan Mollick, a University of Pennsylvania professor who studies AI, said organisations were struggling to keep pace with the growing volume of security updates needed to defend against AI-driven cyberattacks. He warned that frequent and rapid software updates could increasingly become routine for ordinary users as well as businesses.
