Emergency PHP updates trigger global cybersecurity alert as governments and major organisations race to shield their systems from potential attacks
Government websites across Europe and other parts of the world were taken offline on Wednesday as a cybersecurity emergency unfolded following the discovery of critical vulnerabilities in PHP, one of the internet’s most widely used programming languages.
The flaws, uncovered with the help of artificial intelligence, prompted developers to release emergency security updates on October 21, triggering an urgent response from governments, technology companies and cybersecurity experts concerned that vulnerable systems could be targeted by hackers.
The developers urged users to install the fixes immediately, while technology companies warned that some of the weaknesses were already being exploited. With details of the vulnerabilities now public, security specialists fear attackers could move quickly against websites that remain unpatched.
The crisis has exposed a growing cybersecurity dilemma: artificial intelligence is helping researchers uncover dangerous weaknesses that have remained hidden for years, but the same technology could also enable malicious actors to exploit them at unprecedented speed.
Costin Raiu, co-founder of cybersecurity research and incident response firm TLP, described the situation as an AI-driven race to exploit vulnerable systems, warning that the next phase could involve widespread compromises of exposed web servers across the internet.
PHP plays a central role in the digital infrastructure used by governments, businesses and millions of internet users. It supports popular website platforms and content management systems, including WordPress, Drupal, Joomla and Magento.
Developed in the early 1990s, PHP processes website content on servers before delivering it to visitors’ browsers. According to web technology tracker W3Techs, the language powers roughly 75 per cent of websites whose server-side programming language can be identified.
That widespread adoption has raised concerns about the potential reach of the newly discovered flaws. Tiffany Farriss, interim chief executive of the Drupal Association, warned that the vulnerabilities affected PHP versions released over the past two decades, highlighting the scale of the possible exposure.
Cybersecurity agencies in Europe, Australia, Japan and Britain have urged website operators to install the security updates without delay or temporarily take affected services offline until their systems can be protected.
Japan’s Prime Minister, Sanae Takaichi, also urged website operators to establish whether their live systems use PHP and prepare to apply the necessary fixes.
Artificial Intelligence Accelerates the Cybersecurity Race
Cybersecurity company Wiz, owned by Alphabet, said artificial intelligence played a key role in helping researchers uncover vulnerabilities that had remained hidden in PHP’s code for more than a decade.
The company explained that identifying and exploiting the weaknesses would previously have required considerable manual effort and advanced technical expertise, making attacks difficult to scale. AI, however, is lowering those barriers, potentially allowing complex vulnerabilities to be identified and exploited much faster.
Wiz said its investigation used Wiz Atlas, its autonomous AI vulnerability research tool, alongside Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol.
The research involved collaboration with the PHP development team, OpenAI and cybersecurity firm Calif to identify the vulnerabilities and verify the fixes.
Wiz also coordinated with major technology and internet infrastructure providers, including Google Cloud, Cloudflare, Amazon Web Services, Microsoft, Automattic, Fastly, Akamai, Imperva and Vercel, to prepare protective measures for customers.
The White House said it had been briefed on the vulnerability on Friday, describing the discovery as evidence of how American leadership in artificial intelligence could strengthen national security.
But the breakthrough has also heightened fears that hackers could use increasingly sophisticated AI tools to turn publicly available vulnerability information into a wave of cyberattacks against unprotected systems.
Lukasz Olejnik, a visiting senior research fellow at King’s College London, warned that the sheer number of potentially affected systems made the situation particularly serious, with AI potentially accelerating exploitation on a massive scale.
Smaller websites could face some of the greatest challenges. Individuals, small businesses and organisations with limited technical resources may struggle to identify affected systems and install emergency updates quickly enough.
Many also depend on shared hosting services, where website owners have limited control over the servers running their platforms. This could delay the installation of security patches and leave some websites exposed even after fixes become available.
Shutdowns Spread Across Europe and Beyond
The impact of the security alert has already extended across several countries, with government agencies and major organisations taking preventive action to protect their digital infrastructure.
In the Netherlands, the National Cyber Security Centre took its website offline as a precaution. Several other organisations followed, including the Port of Rotterdam, government information portal Overheid.nl, national football association KNVB and the websites of the country’s five largest political parties.
Denmark also experienced disruption after municipal IT company Kombit shut down several services, including the country’s national school communication platform.
In Finland, state IT services provider Valtori announced that government public network services had been taken offline as a precautionary measure.
France’s Interior Ministry placed all its websites under preventive maintenance, adding to the growing list of public institutions limiting online access while the threat was assessed.
The disruption was not confined to Europe. Japanese cloud provider Sakura Internet suspended a database appliance function on Wednesday, while Wikipedia’s operator reported taking an unspecified number of systems offline until they could be safely patched.
The precautionary shutdowns reflect the difficult balance facing organisations: keeping websites operational while preventing potential intrusions that could compromise sensitive information, disrupt essential services or expose critical infrastructure to attack.
With emergency fixes now available, administrators are under pressure to identify vulnerable PHP installations, apply the updates and confirm that their systems are secure before restoring affected services.
The incident has also raised broader questions about the future of cybersecurity in an era when artificial intelligence can accelerate both defence and attack.
For governments, businesses and website operators worldwide, the immediate challenge is clear: close the security gaps before hackers exploit them. The speed at which that happens could determine whether the crisis remains a contained disruption or escalates into a much wider cyber incident.
