Government websites and online services across Europe and other regions were temporarily taken offline after the disclosure of critical vulnerabilities in PHP, one of the world’s most widely used programming languages. The security flaws, which were discovered with the assistance of artificial intelligence, prompted software maintainers to issue emergency patches and encouraged organizations to update their systems immediately. Security experts warned that the public release of the fixes could enable threat actors to quickly analyze the vulnerabilities and develop working exploits, increasing the urgency for website operators to secure affected systems. PHP powers a significant portion of the internet, including websites built on WordPress, Drupal, Joomla and Magento, making the issue one of the most significant web security events in recent years. Developers behind PHP stated that the vulnerabilities had remained undiscovered for years and urged all users to install the latest updates without delay.
Cybersecurity researchers warned that the combination of publicly available patches and increasingly capable AI tools could accelerate attempts to exploit unpatched servers. Costin Raiu, co founder of cybersecurity research and incident response firm TLP:Black, described the situation as a race to exploit vulnerable systems, warning that organizations delaying updates could face widespread compromise. Tiffany Farriss, interim chief executive of Drupal Association, said the issue affects the majority of the internet because virtually every supported PHP release from the past two decades is impacted. Cybersecurity authorities in several countries advised organizations either to apply updates immediately or temporarily take affected websites offline until systems could be secured. Internet intelligence company Censys estimated that around 1.5 million of approximately 2.6 million internet hosts are currently running PHP versions for which no security fix is available. As a precaution, multiple organizations temporarily suspended online services, including the Dutch cybersecurity agency, selected Wikipedia infrastructure and Internet Archive systems, while government officials in several countries publicly urged website administrators to verify whether their environments rely on PHP and to deploy the new patches.
The vulnerabilities were independently identified by cybersecurity firms Calif and Wiz with assistance from advanced artificial intelligence systems. Calif disclosed that it initially discovered the flaws in early August using a large language model before coordinating responsible disclosure efforts with the PHP development team. Wiz reported that its researchers used its autonomous AI vulnerability research platform, Wiz Atlas, together with Google Gemini 4 Argon and OpenAI GPT 5.6 Sol during its analysis. According to Wiz, the vulnerabilities had remained hidden within PHP for more than a decade and would have been extremely difficult to identify and exploit through traditional manual research alone. The company stated that AI significantly reduced the technical barriers involved in analyzing complex software behavior, making vulnerability research and exploit development considerably more efficient. Both companies said they coordinated their findings with each other, OpenAI and the PHP maintainers before public disclosure to support the release of security fixes.
Further concern emerged after Amazon disclosed that its security team observed attempts to target one of its honeypot systems several days before the vulnerabilities became public. Amazon security chief CJ Moses said the initial activity was detected on October 17, followed by additional attempts from multiple actors before the disclosure embargo ended. Although it remains unclear whether those attempts would have succeeded against production environments, Amazon stated that the vulnerabilities are now being broadly exploited in the wild. PHP currently supports roughly three quarters of websites whose server side technologies have been identified, according to web technology tracker W3Techs, making rapid patching essential for organizations of every size. Hosted platforms such as WordPress.com and Tumblr confirmed their managed services were protected, but experts cautioned that independently managed websites and organizations with limited technical resources may face greater exposure. Government organizations across the Netherlands, Finland, France and Denmark temporarily suspended online services as preventive measures while security teams applied updates, highlighting the broad operational impact of the newly disclosed PHP vulnerabilities.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
