AI-discovered PHP flaws force government websites offline across Europe

Government websites and online services across parts of Europe were taken offline on Wednesday (October 21) after the disclosure of two critical security vulnerabilities in PHP, one of the world’s most widely used web programming languages.

Government agencies in the Netherlands, France, Denmark and Finland were among organisations that temporarily shut down websites and services as a precaution while administrators rushed to install security updates. Technology companies have also detected attempts by hackers to exploit the flaws.

The PHP development team released emergency security updates on Wednesday covering PHP versions 8.2 to 8.5. The two vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, are each rated 9.2 out of 10 under the Common Vulnerability Scoring System.

Both flaws can allow unauthenticated remote code execution, meaning attackers could potentially run malicious code on vulnerable servers without first obtaining login credentials.

PHP developers said there were no complete alternative safeguards and urged users to update immediately.

Governments take services offline as precaution

Authorities around Europe responded by temporarily disabling affected systems while patches were installed.

In the Netherlands, the National Cyber Security Centre took its own website offline as a precaution. Other Dutch organisations taking similar action included the Port of Rotterdam, the government portal Overheid.nl, the KNVB national football association, websites belonging to the country’s five largest political parties and several hospitals.

Danish municipal IT company Kombit shut down several services, including a national school communications platform, while Finland’s state IT services provider Valtori took government public-network services offline.

France’s Interior Ministry placed all of its websites into preventive maintenance.

The disruption extended beyond government services. The operator of Wikipedia temporarily disabled an unspecified number of systems until patches could be safely applied, while the Internet Archive also briefly went offline to address the vulnerability.

Japanese Prime Minister Sanae Takaichi urged website operators to check whether their services used PHP and prepare to install the new security updates.

PHP powers a large part of the web

PHP is a free, open-source programming language that has been used for web development since the early 1990s. When someone visits a PHP-powered website, the software running on the server processes and assembles the page before sending it to the visitor’s browser.

It forms part of the technology underlying platforms including WordPress, Drupal, Joomla and Magento.

According to W3Techs data cited by Reuters, PHP is used by roughly 75% of websites where the server-side programming language can be identified, giving vulnerabilities in its core software potentially far-reaching consequences.

Tiffany Farriss, interim chief executive of the Drupal Association, warned that PHP servers running versions released over the past two decades could be exposed to the newly disclosed flaws. Her position and spelling are confirmed by the Drupal Association.

Data from internet-intelligence company Censys showed that about 1.5 million of 2.6 million detected hosts reported running PHP versions for which no fix was then available, underscoring the scale of the challenge facing website administrators.

AI helps uncover decade-old vulnerabilities

The vulnerabilities had remained hidden in PHP’s code for more than a decade before being independently discovered by cybersecurity researchers using artificial intelligence.

Cybersecurity company Calif told Reuters that it discovered the flaws with the assistance of a large language model on August 1 and had been working on remediation since then.

Alphabet-owned cybersecurity company Wiz separately found the vulnerabilities using Wiz Atlas, its autonomous AI security-research system, together with Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol.

Wiz said the vulnerable code had been present for more than 10 years and that exploiting it would have required highly complex work by human researchers before advances in AI.

The company said its researchers discovered the first vulnerability on August 19, confirmed unauthenticated remote-code execution against Drupal the following day and against WordPress on August 21. It reported the vulnerabilities to the PHP security team on August 24.

Wiz, Calif, the PHP team and OpenAI subsequently coordinated their work ahead of the public disclosure and release of security patches on October 21.

Costin Raiu, co-founder of cybersecurity research and incident-response company TLP, told Reuters that AI was accelerating a “race to exploit” vulnerabilities, raising the prospect of widespread attacks against servers that had not yet been updated.

Hackers attempted exploitation before public disclosure

Evidence of attempted exploitation emerged even before details of the vulnerabilities were made public.

Amazon security chief CJ Moses said the company detected an attempt to exploit the flaws against one of its “honeypot” systems — decoy infrastructure designed to detect malicious activity — on October 17, four days before public disclosure.

The attempt came from an anonymous internet address, indicating possible activity by a cyber threat actor, although Amazon said it remained unclear how the attacker had learned about vulnerabilities that were still under an information embargo.

Further exploitation attempts by several actors were detected on Wednesday before the embargo ended. Amazon later described the vulnerabilities as being broadly exploited in the wild, although it said it was unclear whether the earlier attempts would have succeeded against real websites.

The White House said it had been informed about the vulnerabilities on the previous Friday.

Lukasz Olejnik, a visiting senior research fellow at King’s College London, warned that the combination of PHP’s widespread use and AI-assisted exploitation could allow attacks to spread rapidly across servers that had not yet been patched.

PHP’s developers have urged administrators to install the latest versions immediately, saying updating is the only safe response because no complete mitigation exists for the two critical flaws.

Source: Reuters