Websites across the world have gone offline following the discovery of a critical vulnerability in PHP, a programming language used to build nearly 70 per cent of websites globally.
Websites in Belgium, the Netherlands, Finland, France and Germany were among those temporarily taken down by authorities as they rushed to fix the security flaw.
The vulnerability, which became public on Tuesday, prompted warnings from national security agencies in the United States and the United Kingdom. The flaw could expose millions of websites to cyber-attacks, forcing operators to update their systems to address the weakness.
An internet infrastructure expert warned that Russian state-backed actors or organised criminal groups could exploit the vulnerability to launch cyber-attacks.
WordPress, one of the world’s most widely used website platforms, relies on PHP, as do Wikipedia, messaging platform Slack and, historically, much of Facebook.
The Wikimedia Foundation said it had temporarily taken several systems offline on Wednesday as a precaution while security patches were applied.
The team responsible for PHP released a security patch on Wednesday after researchers conducting cybersecurity tests discovered the vulnerability.
The United States National Security Agency advised organisations using PHP to take their systems offline if they could not install the patch immediately. It warned that the flaw could “provide a direct path to the server’s file system or database”.
The United Kingdom’s National Cyber Security Centre issued similar guidance, urging organisations to inspect their systems for potential backdoors installed by attackers.
Experts warned of a possible surge in cyber-attacks, as the public release of a fix and the ability of AI tools to reverse-engineer the vulnerability with little effort could enable hackers to exploit the flaw before organisations complete their security updates.
Cybersecurity firm Calif said it discovered the vulnerabilities on 1 August with the help of a large language model and had been working on a fix since then.
In a separate blog post, Alphabet-owned cybersecurity company Wiz said it also identified the flaws using its autonomous AI vulnerability research tool, Wiz Atlas, alongside Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol.
According to Wiz, the vulnerabilities had remained undetected in PHP’s codebase for more than a decade.
The company added that exploiting the flaws would have been extremely difficult for a human hacker.
