Governments and businesses worldwide have taken websites and online services offline as they scramble to fix critical security vulnerabilities discovered in PHP, a programming language that powers about 70 per cent of websites globally.
The flaws were uncovered with the help of artificial intelligence (AI), raising fresh concerns about the growing ability of AI models to identify weaknesses in computer systems that have gone undetected for years.
According to cybersecurity firm Wiz Research, the vulnerabilities affect PHP, which supports websites ranging from online stores and news platforms to government services.
The PHP Foundation, which supports the development of the programming language, released a security fix on Wednesday and urged users to update their systems immediately.
The United States National Security Agency also advised organisations to install the patch without delay or take vulnerable systems offline. Similar warnings were issued by authorities in Japan and the European Union.
Rahat Masood, a senior lecturer in cybersecurity at the University of New South Wales in Sydney, described the discovery as serious, warning that attackers could gain access to affected servers without authorisation or login credentials.
Such access could allow hackers to steal sensitive information, alter website content or carry out other malicious activities.
Government websites in Australia, Finland and the Netherlands were among those reportedly taken offline, alongside services operated by insurance companies, transport providers and media organisations.
Some mobile applications were also temporarily suspended while their operators implemented security measures. The Wikimedia Foundation, which operates Wikipedia, warned users of possible service disruptions as it worked to address the vulnerabilities.
AI-assisted discovery raises alarm
Cybersecurity firm Calif reportedly discovered the flaws in August using OpenAI’s GPT-5.6 Sol model during an AI-assisted audit of PHP’s code funded by OpenAI.
Wiz, which is owned by Google, later identified the vulnerabilities independently with the assistance of AI models, including Google’s Gemini 4 Argon and GPT-5.6 Sol.
The vulnerabilities were initially reported privately to PHP developers to allow a fix to be prepared before public disclosure. However, details leaked online on Tuesday, triggering an urgent response ahead of the planned release of the patch.
OpenAI described the discovery as a significant development, demonstrating how AI could identify security weaknesses with potentially far-reaching consequences.
Cybersecurity experts warn that increasingly capable AI systems could enable hackers to identify and exploit vulnerabilities more quickly, intensifying pressure on organisations to secure their digital infrastructure.
Although there was little evidence of significant attacks linked to the flaws at the time of reporting, experts warned that stolen personal information could later be used in phishing campaigns to trick victims into revealing passwords and other sensitive details.
Steve Kerrison, a senior lecturer in cybersecurity at James Cook University in Singapore, cautioned that smaller website operators and individual bloggers might remain exposed for days or months because they were unaware of the vulnerabilities.
Such compromised websites could be exploited to distribute malware, send spam or host malicious content.
Security experts have therefore urged all organisations running PHP on their own servers to install the available security updates promptly and verify that their systems are protected.