AI-discovered flaw triggers global cyber scramble

Govt websites across Europe taken offline as precaution

AMSTERDAM:

Government websites across Europe and elsewhere went offline on Wednesday after critical vulnerabilities in the widely used PHP programming language prompted cybersecurity agencies to issue urgent warnings, with experts fearing a wave of attacks as hackers race to exploit the flaws.

PHP developers released emergency fixes for vulnerabilities that had remained undetected for years and urged users to update immediately. With hackers reportedly already exploiting the weaknesses and patches now publicly available, experts warned that attackers could use artificial intelligence (AI) to identify and exploit vulnerable systems on a massive scale.

"AI was powering a 'race to exploit'," said Costin Raiu, co-founder of cybersecurity research and incident response firm TLP, warning that the next stage could involve the mass compromise of vulnerable web servers worldwide.

PHP underpins a substantial portion of the internet and is used by platforms including WordPress, Drupal, Joomla and Magento. Web technology tracker W3Techs estimates that PHP runs roughly 75% of websites whose programming language can be identified.

"This issue impacts the majority of the Internet," said Tiffany Farriss, interim chief executive of the Drupal Association, adding that servers running PHP versions released over the past 20 years were vulnerable.

Cybersecurity agencies in Europe, Australia, Japan and Britain urged website operators to apply the fixes immediately or take their sites offline until they could be secured. The Dutch National Cyber Security Centre itself temporarily went offline, while the operator of Wikipedia said it had taken an unspecified number of systems down for patching.

In the Netherlands, the Port of Rotterdam, government portal Overheid.nl, the national football association KNVB, websites of the country's five largest political parties and several hospital websites were also taken offline. Finland's state IT services provider suspended government public network services as a precaution, while France's Interior Ministry placed all its websites under preventive maintenance.

In Denmark, municipal IT company Kombit shut down several services, including the national school communication platform. Japanese cloud provider Sakura Internet also suspended a database appliance function.

The vulnerability was discovered using AI tools, cybersecurity company Wiz said. Its researchers used the company's autonomous research tool alongside Google's Gemini 4 Argon and OpenAI's GPT-5.6 Sol, coordinating with PHP developers and other cybersecurity firms to verify the fixes.

Wiz said the flaws had remained hidden in the codebase for more than a decade and would have been difficult for human researchers to exploit at scale. The White House, which said it had been informed on Friday, described the discovery as an example of American innovation strengthening national security.

Experts warned that smaller websites, particularly those hosted on shared servers and managed by operators with limited technical resources, could remain exposed after patches became available. Lukasz Olejnik, a visiting senior research fellow at King's College London, said AI could enable exploitation "instantly, on a large scale".