Governments and companies worldwide took websites offline on Thursday as they scrambled to prevent cyberattacks after artificial intelligence helped uncover critical vulnerabilities in PHP, a programming language used by about 70 per cent of the world’s websites.

The flaws, discovered by cybersecurity researchers at Wiz Research, triggered urgent warnings from security authorities, including the United States National Security Agency, which urged organisations to install a software fix immediately or take vulnerable systems offline.

The vulnerabilities affect websites running PHP on their own servers. PHP powers a wide range of online services, including news outlets, online stores and government platforms.

“These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history,” Wiz Research said in a blog post.

The discovery has intensified concerns about the growing cybersecurity risks posed by increasingly powerful AI models, which can identify weaknesses in computer code that developers may have overlooked for years.

With software vulnerabilities discovered worldwide in 2026 on course to roughly double last year’s record, security experts are warning that AI could accelerate both the discovery of flaws and efforts to exploit them.

PHP developers released a fix on Wednesday, prompting authorities in several countries to urge organisations to update vulnerable systems without delay.

A platform affiliated with China’s Ministry of Industry and Information Technology also issued a warning, describing the flaws as “two critical remote code execution vulnerabilities with severe impact.”

Remote code execution vulnerabilities can allow attackers to run malicious commands on a target server, potentially gaining unauthorised access to sensitive information and website systems.

Rahat Masood, a senior lecturer in cybersecurity at the University of New South Wales in Sydney, described the discovery as “quite devastating.”

She warned that attackers could gain access to servers without authentication, including usernames or passwords.

“Once they are in the servers, they can do anything they want,” she said, citing risks ranging from data theft to unauthorised changes to website content.

Masood urged organisations to treat the vulnerabilities seriously and take immediate steps to secure their systems.

Government websites in Australia, Finland and the Netherlands were among those taken offline, while insurance companies, transport operators and media organisations placed services under emergency maintenance.

Some popular applications were also affected. A Pokémon sleep-tracking app was temporarily taken offline while its operators implemented the fix.

The Wikimedia Foundation, which operates Wikipedia, warned users that they could experience service disruptions as it worked to address the vulnerabilities.

PHP, created in the early 1990s, originally stood for “personal home page” before becoming known as “hypertext preprocessor.” It remains a key technology underpinning many websites and popular web development platforms.

However, the incident does not affect every website. Platforms built with other programming languages, as well as operators able to install the patch quickly, were able to remain online.

The episode highlights the growing challenge facing organisations as AI tools become more capable of identifying long-hidden weaknesses in widely used software, increasing pressure on developers and system operators to respond quickly before attackers exploit them.

With Agency Report