AI-Discovered PHP Flaws Force Government Websites Offline Worldwide

Government agencies and other organizations across Europe and beyond have temporarily taken websites offline after two critical security vulnerabilities were identified in PHP, a widely used programming language, triggering an international scramble to secure potentially exposed systems.

The disruption intensified on Wednesday, October 21, after PHP developers released emergency security updates for the vulnerabilities, which could allow attackers to execute malicious code on affected servers without authentication. The flaws, identified as CVE-2026-109618 and CVE-2026-109619, carry severity ratings of 9.2 out of 10 under the CVSS 4.0 vulnerability scoring system.

The Netherlands, France, Germany, Finland, Belgium and the Czech Republic were among the countries where government websites or other public-facing services were temporarily taken offline as a precaution. The disruptions also affected other organizations, including hospitals, schools and the Wikimedia Foundation, which operates Wikipedia.

The shutdowns followed warnings from cybersecurity agencies that organizations unable to apply the fixes immediately should consider isolating vulnerable systems from the internet until they could be secured. The measures were intended to reduce the risk of attackers exploiting the weaknesses to gain control of servers, compromise sensitive information or interfere with online services.

The vulnerabilities came to light through AI-assisted security research involving OpenAI and cybersecurity firms Calif and Wiz. OpenAI said researchers working with its GPT-5.6 Sol model identified one critical flaw, while Wiz independently discovered and reported both vulnerabilities. The findings were shared with PHP maintainers, who worked with researchers and technology providers to prepare fixes before the public disclosure.

OpenAI said the vulnerabilities had been discovered during a coordinated effort over the preceding two months, allowing developers and security partners time to investigate the problems and prepare protective measures. The company described the episode as an example of how advanced AI systems can identify weaknesses in widely deployed software that may otherwise remain undetected.

PHP is an open-source, server-side programming language used to build websites and web applications. It supports a broad range of online services, including content management systems, commercial platforms and government portals. According to technology tracker W3Techs, PHP runs nearly 70 per cent of websites whose server-side programming language can be identified, giving vulnerabilities in the software an unusually wide potential reach.

The two flaws could allow an unauthenticated attacker to execute commands remotely on a vulnerable server. In practical terms, this means a malicious actor could potentially compromise an exposed system without first obtaining a legitimate user account. The precise consequences would depend on the configuration of the affected server and the privileges available to the compromised process.

The Netherlands temporarily took several public-facing services offline, including Overheid.nl, MijnOverheid.nl and DigiD, which are used for government information and digital identity services. Dutch authorities said the decision was precautionary and that they had not initially identified signs of active exploitation. Government websites and services in France, Germany, Finland and the Czech Republic were also affected, while Belgium’s foreign ministry reported taking its websites offline amid concerns about possible attacks.

The scale of the disruption varied by country and organization. Some operators disabled individual websites, while others suspended broader public-facing services while preparing updates. The shutdowns did not mean that every government website worldwide was affected, nor did they establish that the affected organizations had suffered data breaches.

Security agencies urged organizations to identify systems running PHP, prioritize internet-facing applications and install the appropriate updates as soon as possible. The UK’s National Cyber Security Centre also advised operators who could not update or apply temporary mitigations promptly to consider taking vulnerable systems offline until they could be protected. The European Union Agency for Cybersecurity and other European authorities issued similar guidance.

The timing of the public disclosure added to the urgency. Although the vulnerabilities had been reported privately while fixes were being developed, technical information began circulating before the planned release of the patches. This raised concerns that attackers could use the information to develop working exploits before all vulnerable systems had been updated.

Reports of attempted exploitation emerged as organizations responded to the alerts. Reuters reported that Cloudflare had observed early attacks, while technology companies warned that the weaknesses could be exploited at scale. However, the Australian Signals Directorate’s Australian Cyber Security Centre said it was not aware of active exploitation at the time of its advisory, illustrating that assessments differed across agencies and jurisdictions.

The incident has also drawn attention to the challenges facing organizations that rely on software maintained by relatively small development communities. Because PHP is embedded in many website platforms and third-party products, administrators may not always know which systems depend on it or whether their hosting providers have applied the necessary fixes. Older PHP versions that no longer receive security updates present an additional challenge.