Government agencies, businesses and media organisations worldwide have taken websites and online services offline after artificial intelligence helped cybersecurity researchers uncover critical security vulnerabilities in PHP, a programming language used by millions of websites.

The flaws prompted an urgent global response, with PHP developers releasing a security fix on Wednesday and the United States National Security Agency urging organisations to update vulnerable systems immediately or take them offline.

According to Channels Television, citing Agence France-Presse (AFP), cybersecurity firm Wiz estimated that PHP code supports about 70 per cent of the world’s websites, including online shops, news platforms and government services.

Wiz described the vulnerabilities as among the most severe discovered in PHP and potentially among the most significant in software history.

AI-Discovered Flaws Raise Hacking Fears

The security weaknesses could allow attackers to access vulnerable servers without authorisation, potentially exposing sensitive information and enabling them to alter website content.

Rahat Masood, a senior lecturer in cybersecurity at the University of New South Wales in Sydney, described the discovery as devastating.

She warned that attackers who gained access to affected servers could carry out a range of malicious activities, stressing the need for organisations to take immediate action.

However, the vulnerabilities affect only websites running PHP on their own servers. Platforms using other programming languages or operators capable of applying the security fix quickly were able to remain online.

The incident has intensified concerns about the growing cybersecurity risks associated with increasingly powerful artificial intelligence systems, which can identify weaknesses in computer code that may have escaped human detection for years.

Websites Taken Offline Worldwide

Government websites in countries including Australia and the Netherlands were among those affected by the emergency response.

Insurance companies, transport operators and media organisations also carried out urgent maintenance as they worked to secure their systems.

In France, several local government websites, including the Paris police website, were made inaccessible at the request of the country’s National Cybersecurity Agency, according to the interior ministry.

The Wikimedia Foundation, which operates Wikipedia, warned users that its services could experience disruptions while it addressed the vulnerabilities. The organisation also temporarily took several supporting services offline until they could be safely updated.

Some popular applications, including a Pokémon sleep-tracking app, were also temporarily taken offline during the patching process.

Japan’s prime minister urged businesses to act urgently to protect their systems, while South Korea’s government instructed technology departments to update vulnerable software.

Security Researchers Used AI Models

The vulnerabilities were discovered by cybersecurity firm Calif in August during an audit of PHP’s code using OpenAI’s GPT-5.6 Sol model. The audit was funded by OpenAI.

OpenAI subsequently described the findings as among the most impactful vulnerabilities identified in recent memory, noting that the discovery demonstrated how artificial intelligence could identify security weaknesses with potentially global consequences.

Cybersecurity firm Wiz independently discovered the flaws weeks later, using artificial intelligence models that included Google’s Gemini 4 Argon and GPT-5.6 Sol.

The PHP Foundation, which supports developers working on the programming language, urged organisations running PHP to install the available security updates immediately.

Volker Dusch, a security engineer at the foundation, told The Wall Street Journal that the incident was the most serious security problem PHP had faced in more than a decade.

He compared it to Heartbleed, a major software vulnerability discovered in 2014 that triggered an international effort to secure affected systems.

Leaked Details Trigger Emergency Response

PHP developers had been privately informed about the vulnerabilities and kept the details confidential while preparing a fix.

However, information about the flaws leaked online on Tuesday, a day before the planned release of the security update.

The leak accelerated efforts to take vulnerable websites offline before malicious actors could exploit the weaknesses.

The incident also highlights the challenge organisations face in keeping pace with emerging cyber threats as AI tools become more capable of identifying weaknesses in widely used software.

Ethan Mollick, a professor at the University of Pennsylvania’s Wharton School who studies artificial intelligence, said businesses were struggling to keep up with the increasing pace of security updates needed to defend against AI-driven cyberattacks.

The discovery has raised fresh questions about how organisations will maintain digital security as artificial intelligence makes it easier to identify vulnerabilities across widely used technologies.