LAST UPDATE | 22 Oct

GOVERNMENT AGENCIES AND companies around the world shut down websites as they raced to protect themselves from hacks after artificial intelligence uncovered critical flaws in a widely used programming language called PHP.

It comes as chief executive of a global cloud infrastructure and cybersecurity company Cloudflare warned that there have been “millions” of attempted security breaches.

Many online services use PHP but two critical vulnerabilities were found with PHP and an update was issued. However, online services that have yet to install the update may be at risk from hackers.

These vulnerabilities can provide a direct path to the server’s file system or database, meaning hackers could potentially get user information such as passwords, credit card details and contact details.

Governments across Europe, including in the UK, France, Finland, have taken its state internet services offline, and the Netherlands’ cycbersecurity agency has taken its website down. State websites in Australia and Japan have also been impacted.

Ireland’s National Cyber Security Centre (NCSC) has issued an advisory about the update, as have its UK and EU-wide counterparts.

Cloudflare CEO Matthew Prince posted on social media outlining that the site quickly saw thousands and eventually millions of attempts to target the vulnerabilities since the issue emerged.

Prince said:

In the 10 hours before it was publicly announced, across the Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.

Wiz, one of the cybersecurity firms that found the two flaws, estimated that PHP code helps run about 70 percent of the world’s websites – from online stores and news outlets to government services.

It called the flaws “among the most severe vulnerabilities discovered in PHP, and arguably in software history”.

PHP programmers released a fix on Wednesday, and the US National Security Agency told organizations to patch their sites immediately or pull vulnerable systems offline.

Only sites that run PHP on their own servers are exposed. Many large platforms are built on other programming languages or use operators that could install the fix quickly and were able to stay online.

Rahat Masood, senior lecturer in cybersecurity at the University of New South Wales, Sydney, called the discovery “quite devastating.”

It could allow “attackers to get into your servers without any authorisation, without any username or password,” she told AFP.

“Once they are in the servers, they can do anything they want” — from stealing sensitive information to modifying website content — she added, urging institutions to “take it seriously.”

Increasingly powerful AI models can spot weak points in computer scripts that have gone unnoticed by humans for decades.

That has heightened fears over cybersecurity risks, with the number of software vulnerabilities found worldwide in 2026 on track to roughly double last year’s record total.

Government-run sites in countries from Australia to the Netherlands were among those that went dark, while insurance firms, transport operators and media outlets were under emergency maintenance.

Japan’s prime minister advised businesses to act to protect themselves “with great urgency,” while South Korea’s government also instructed organizations’ tech departments to update their software.

‘New phase’

“If you run PHP, it is imperative that you update now,” the PHP Foundation, which funds developers working on the language, said in a blog post.

Volker Dusch, a security engineer at the foundation, told the Wall Street Journal it was the most serious problem PHP had faced in more than a decade, comparing it to Heartbleed, a 2014 flaw that set off a worldwide rush to patch.

Security firm Calif found the flaws in August using OpenAI’s GPT-5.6 Sol model, as part of an OpenAI-funded audit of PHP’s code.

OpenAI said on X it considered the flaws “one of the most impactful vulnerabilities in recent memory.”

The discovery “marks a new phase, where AI can find security bugs with internet-scale impact,” it added.

Wiz, which is owned by Google, said it found them independently weeks later with help from AI models including Google’s Gemini 4 Argon and GPT-5.6 Sol.

Ethan Mollick, a professor at the University of Pennsylvania’s Wharton School who studies AI, said companies he talks to are struggling to keep up with the pace of patches needed to guard against AI-driven cyberattacks.

“Now consumers are going to have the same experience of getting everything updated often and fast,” he wrote on X.

The flaws had been reported privately to PHP’s developers and kept confidential while a fix was prepared.

Details leaked online Tuesday, a day before the planned release of the fix, prompting the rush to take sites offline before hackers could exploit them.

In France, local government websites, including one for the Paris police, were made inaccessible at the request of the French National Cybersecurity Agency, the interior ministry said.

The Wikimedia Foundation, which runs Wikipedia, warned users they could see outages on its sites while it addressed the flaws, and said it had deliberately taken many of its supporting services offline until they could be safely patched.

Popular apps, including a Pokemon sleep tracker, were also temporarily taken offline while the fix was implemented.

The Journal’s website is also temporarily affected, although our newsroom is still operating as normal.

Comments are unavailable right now as we upgrade some of our systems.