Governments and companies around the world shut down websites Thursday as they raced to protect themselves from hacks after artificial intelligence uncovered critical flaws in a widely used programming language called PHP.
PHP helps run about 70 percent of the world's websites -- from online stores and news outlets to government services -- according to Wiz Research, one of the cybersecurity firms that found the two flaws.
Created in the early 1990s, PHP originally stood for "personal home page" but now means "hypertext preprocessor" and sits underneath popular web design platforms.
"These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history," a Wiz blog post said.
Increasingly powerful AI models can spot weak points in back-end computer code that have gone unnoticed by humans for years.
That has heightened cybersecurity fears, with the number of software vulnerabilities discovered worldwide in 2026 on track to roughly double last year's record total.
- 'Quite devastating' -
PHP programmers released a fix Wednesday, and the US National Security Agency told organizations to patch their sites immediately or pull vulnerable systems offline -- a call echoed by authorities from China to the European Union.
Amazon Threat Intelligence said it had identified a hacking attempt carried out before the PHP security flaws were made public.
"It remains unclear how the actor acquired exploit information," it said, describing the incident as the "targeting of a honeypot" from an anonymised internet connection.
But Ryan Austin, who has worked on PHP issues for cybersecurity firm Calif, told the BBC: "at the moment, it doesn't look like exploitation has taken off or been widespread."
Only sites that run PHP on their own servers are exposed. Many large platforms are built on other programming languages or use operators that could install the fix quickly and were able to stay online.
Rahat Masood, senior lecturer in cybersecurity at the University of New South Wales, Sydney, described the discovery as "quite devastating".
It could allow "attackers to get into your servers without any authorisation, without any username or password", she told AFP.
"Once they are in the servers, they can do anything they want" -- from stealing sensitive information to modifying website content -- she added, urging institutions to "take it seriously."
- 'New phase' -
Government agency sites in countries from Australia to Finland, the Netherlands and the United Kingdom were among those that went dark. Services from insurance firms, transport operators and media outlets were down for emergency maintenance.
Popular apps, including a Pokemon sleep tracker, were also temporarily taken offline while the fix was implemented, while the foundation that runs Wikipedia warned users they could see outages while it addressed the flaws.
"If you run PHP, it is imperative that you update now," the PHP Foundation, which funds developers working on the language, said in a blog post.
Volker Dusch, a security engineer at the foundation, told the Wall Street Journal it was the most serious problem PHP had faced in more than a decade, comparing it to Heartbleed, a 2014 flaw that set off a worldwide rush to patch.
Security firm Calif found the flaws in August using OpenAI's GPT-5.6 Sol model, as part of an OpenAI-funded audit of PHP's code.
OpenAI said the discovery "marks a new phase, where AI can find security bugs with internet-scale impact."
Wiz, which is owned by Google, said it found them independently weeks later with help from AI models including Google's Gemini 4 Argon and GPT-5.6 Sol.
The flaws had been reported privately to PHP's developers and kept confidential while a fix was prepared.
- AI fuels urgency -
Details leaked online Tuesday, a day before the planned release of the fix -- prompting the rush to take sites offline before hackers could exploit them.
Steve Kerrison, senior lecturer in cybersecurity at the Singapore campus of James Cook University, told AFP that the fear of hackers using AI to quickly and easily exploit the PHP vulnerabilities had fuelled urgency to react.
Larger institutions, from government agencies to news outlets, should be able to fix their websites relatively fast, Kerrison said -- but others may be left vulnerable.
"There are sites, systems and people out there who will have no idea about this and still won't for days, weeks and months," Kerrison warned.
That may include user-run blogs that could be weaponised to spread computer viruses, spam people or distribute malicious content, he said.
Main photo: An illustration picture taken on October 21 shows a padlock in front of binary code on a laptop screen in Frankfurt am Main, western Germany.//AFP
