Governments Take Websites Offline After AI Helps Uncover Critical PHP Security Flaws

Governments and organisations across Europe and other parts of the world have temporarily taken websites offline following the discovery of two serious security vulnerabilities in PHP, a programming language that powers millions of websites and web applications. The emergency response began on October 21, 2026, after cybersecurity researchers and software developers warned that the flaws could allow attackers to execute malicious code on vulnerable servers without proper authorisation. Several organisations chose to suspend online services while security updates were prepared and installed, prioritising the protection of sensitive information over uninterrupted access to their websites. According to Reuters, the affected organisations included government agencies in Germany, France, Finland, Belgium and the Netherlands, as well as companies and public institutions elsewhere. The incident has highlighted the risks associated with vulnerabilities in widely used software infrastructure.

The vulnerabilities attracted particular attention because PHP is used across a substantial portion of the internet, including websites built with popular content-management systems such as WordPress, Drupal and Joomla. Security researchers warned that successful exploitation could potentially allow criminals to access server files, interfere with databases, steal sensitive information or use compromised systems as a starting point for further attacks. The precise consequences would depend on the affected software, its configuration and the permissions available to an attacker. The PHP development community released emergency security updates and urged website operators to install the appropriate fixes immediately. Organisations that could not update their systems quickly were advised by cybersecurity authorities to consider temporarily disabling vulnerable services until they could be secured.

Several prominent institutions took precautionary action as the warnings spread. In the Netherlands, affected organisations included the Port of Rotterdam, the government portal Overheid.nl and the country’s national cybersecurity centre. Finland temporarily shut down public-facing government web services, while France placed websites belonging to local administrative authorities into preventive maintenance. Germany also deactivated several government websites, and Belgium’s foreign ministry temporarily suspended its online services. Japan partially suspended some government services, while the BBC reported taking certain web portals offline in the United Kingdom. The Wikimedia Foundation, which operates Wikipedia, said it had taken some systems offline while addressing the vulnerabilities. Many organisations described these measures as precautionary, and officials in several countries said they had not identified evidence that their own systems had been compromised.

Artificial intelligence played an important role in identifying the security weaknesses. Cybersecurity company Calif reportedly discovered the vulnerabilities during an investigation supported by OpenAI, while Alphabet-owned security company Wiz independently identified the issues using AI-assisted security research tools. OpenAI said it had worked with researchers, software maintainers and cybersecurity organisations to help address the vulnerabilities before public disclosure. The episode demonstrates how advanced AI models can analyse large amounts of software code and help security specialists identify flaws that may have remained undetected for years. However, the same capabilities create new challenges because malicious actors may also use AI to understand vulnerabilities and develop attacks more quickly. Security experts therefore warned that once technical details became public, organisations running unpatched systems could face increased pressure from attackers attempting to exploit the weaknesses.

The incident has renewed concerns about the security of essential internet infrastructure and the ability of organisations to respond quickly to emerging cyber threats. Although PHP’s developers released fixes, updating a complex website can require testing, compatibility checks and coordination between hosting providers, software vendors and administrators. Smaller organisations may face additional difficulties because they often lack dedicated cybersecurity teams and may not directly control the servers on which their websites operate. Experts recommend identifying systems that use vulnerable software, applying official security updates promptly, reviewing access controls and monitoring for suspicious activity. Organisations should also maintain reliable backups and use additional safeguards, including multi-factor authentication where appropriate. The incident does not mean that every website using PHP was hacked, but it illustrates why rapid patching and responsible security management are essential. As AI continues to accelerate both vulnerability discovery and potential exploitation, cooperation between researchers, developers and website operators will remain critical to protecting the global internet.