By Sumayya
Government websites in Europe and other places went offline on Wednesday. This happened after people found dangerous weaknesses (vulnerabilities) in a very popular programming language. Website operators all over the world are now rushing to protect their computer systems.
The developers who make the PHP programming language released urgent new fixes on Wednesday. These weaknesses had been hidden quietly in their software for years until they were discovered using Artificial Intelligence (AI). The developers said that all users are “encouraged to update immediately.”
Tech companies are warning that some hackers are already using these flaws to attack. Because of this, government agencies across Europe were among those that shut their websites down as a safety step.
Since the fix is now public and AI tools can figure out how the software bug works with very little effort, experts said they are getting ready for a wave of cyberattacks. Hackers are rushing to attack before people can install the fixes.
AI is creating a “race to exploit,” said Costin Raiu, who is the co-founder of the cybersecurity research and emergency response company TLP:Black. He said the next step would be the “mass compromise of every vulnerable web server on the internet.”
PHP is a language that goes back to the early 1990s. It originally stood for “Personal Home Page.” Today, it supports huge parts of the public internet. It is built into websites that use WordPress, Drupal, Joomla, and Magento. This means any major weakness in PHP can cause massive problems everywhere.
“All servers using any version of PHP released in the last 20 years will be vulnerable,” said Tiffany Farriss, the interim chief executive of the Drupal Association. “This issue impacts the majority of the Internet.”
Cybersecurity agencies in Europe, Australia, Japan, and Britain have told PHP users to update right away or turn their websites off until the safety fixes (patches) can be put in place.
The Dutch cybersecurity agency itself went offline. They said they did this as a safety step because of these weaknesses. The operators of the online encyclopedia Wikipedia also said they took down an unstated number of systems until they could safely fix them.
Even some world leaders, who usually do not get involved in software updates, spoke about it. Japanese Prime Minister Sanae Takaichi posted on X that website owners should “check whether your live site uses PHP and prepare to apply the new fix.”
Bug found with AI
The flaw in PHP was found using artificial intelligence, according to a blog post by the cybersecurity company Wiz, which is owned by Alphabet.
The weaknesses stayed hidden in the PHP code for more than 10 years (a decade). The post mentioned that it would have been incredibly complicated for a human hacker to discover and use them.
“Pre-AI, this manual work would be difficult to implement and even harder to scale,” the post stated. “With AI this is no longer a barrier.”
Wiz said its research used Wiz Atlas, which is its own independent AI tool for finding software flaws. They also used Google’s Gemini 4 Argon
and OpenAI’s GPT-5.6 Sol. Wiz explained that it worked together with the PHP team, OpenAI, and the cybersecurity company Calif to find the weakness and check the fix.
The company said it also teamed up with Google Cloud, Cloudflare, Amazon’s AWS, Microsoft, WordPress.com operator Automattic, and other companies like Fastly, Akamai, Imperva, and Vercel to protect customers and prepare defenses.
In a statement, the White House said it was told about the flaw on Friday.
“This discovery demonstrates exactly why American leadership in SI is so critical,” the White House said. They used the term “SI” because that is U.S. President Donald Trump’s preferred term for artificial intelligence. “This is American innovation strengthening our national security.”
Critical software
PHP is a programming language used to run websites. When a visitor opens a page, a server running PHP builds the content and sends it to the web browser. It is free, open-source software that is looked after by volunteers.
Because it is used everywhere—PHP runs about 75 percent of websites whose programming language can be identified, according to web tracker W3Techs—and because the flaws are so dangerous, experts are worried that a huge number of websites are completely unprotected. AI-assisted hacking attacks have grown quickly in recent weeks, and this will only make things worse, said Lukasz Olejnik, a visiting senior research fellow at King’s College London.
“The scale is huge, and with AI exploitation may happen instantly, on a large scale,” Olejnik said.
The danger is especially high for small websites run by single people or groups with very little tech staff. These sites often use shared hosting services where the customers do not directly manage the main servers. Security experts said these specific sites could take a longer time to patch and will stay at risk long after the fixes are ready.
Mass outages
In the Netherlands, many organizations followed the example of the National Cyber Security Centre and took their public websites offline. This included the Port of Rotterdam, the government portal Overheid.nl, the national soccer association KNVB, the websites for the country’s five largest political parties, and several hospital websites.
The Danish municipal IT company Kombit said it shut down several services, including the national school communication platform.
The disruption was even bigger in Finland, where the state IT services provider Valtori said government public network services were taken offline “as a precautionary measure.”
France’s Interior Ministry said it put all of its websites into preventive maintenance mode. The Japanese cloud service provider Sakura Internet said on Wednesday that it stopped a database tool function.
