Governments and organisations across Europe took websites and online services offline on Wednesday after critical vulnerabilities were discovered in PHP, a widely used programming language that powers
a large portion of the internet.
The security flaws, which were uncovered with the help of artificial intelligence (AI), prompted urgent action from website operators to protect their systems against potential cyberattacks.
The vulnerabilities had remained hidden in PHP’s codebase for years, with developers releasing urgent fixes on Wednesday and urging users to update their systems immediately.
Cybersecurity agencies also advised operators to temporarily take websites offline if they could not apply the security patches.
According to Reuters, government agencies across Europe were among those that took their websites offline as a precaution, amid concerns that the vulnerabilities could be exploited by malicious actors.
Government Websites, Public Services Disrupted
The Netherlands, Finland and France were among the countries affected by the security concerns, with disruptions extending to public services and other major organisations.
In the Netherlands, the National Cyber Security Centre took its website offline as a precaution.
Several other organisations followed suit, including the Port of Rotterdam, government portal Overheid.nl, the national football association KNVB, the websites of the country’s five largest political parties and several hospital websites, Reuters reported.
Danish municipal IT company Kombit also shut down several services, including the national school communication platform.
In Finland, the disruption was more widespread. State IT services provider Valtori took government public network services offline as a precautionary measure.
The Finnish government’s website was also partly unavailable on Wednesday, with a notice informing visitors that government websites were experiencing temporary disruptions while the issue was being resolved, according to AP.
France’s Interior Ministry placed all its websites under preventive maintenance, Reuters reported.
The disruption was not limited to government agencies.
Reuters reported that the operator of online encyclopedia Wikipedia had taken an unspecified number of systems offline until they could be safely patched. The Internet Archive, an online library, also briefly went offline to address the issue.
AI-Discovered Flaws Trigger Urgent Security Response
The vulnerabilities were identified with the assistance of artificial intelligence, highlighting how AI tools can help cybersecurity researchers uncover weaknesses that may have remained undetected for years.
Reuters reported that cybersecurity companies Calif and Wiz independently identified the PHP flaws using AI-assisted tools.
Calif said it had found the vulnerabilities with the help of a large language model on August 1 and had been working on a fix since then.
Wiz said it discovered the vulnerabilities using its autonomous AI vulnerability research tool, Wiz Atlas, alongside Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol.
The companies coordinated with one another, the PHP team and OpenAI, on the discovery, according to Reuters.
The PHP developers released fixes on Wednesday, urging users to update immediately.
Reuters also reported that the public availability of the fixes, combined with the ability of AI tools to reverse-engineer the flaws, raised concerns that hackers could quickly develop exploits targeting systems that remained unpatched.
Millions Of Internet Hosts Potentially Exposed
The scale of the issue has heightened concerns among cybersecurity experts because PHP is widely used to run websites and web applications, including platforms built on WordPress, Drupal, Joomla and Magento.
According to data from internet intelligence firm Censys cited by Reuters, around 1.5 million of the 2.6 million hosts reporting PHP usage were running versions for which no fix was available.
Tiffany Farriss, interim chief executive of the Drupal Association, warned that the vulnerability affected a broad range of systems.
“All servers using any version of PHP released in the last 20 years will be vulnerable,” Farriss said, according to Reuters. “This issue impacts the majority of the internet.”
Reuters also reported that Amazon’s security team detected an attempt to exploit the vulnerabilities against one of its decoy systems on October 17, four days before public disclosure.
Amazon said further attempts were detected on Wednesday, although it remained unclear whether any would have succeeded against real websites.
