Critical PHP Flaws Force Websites Offline Across Several Countries

Two critical security vulnerabilities have been discovered in PHP, a programming language that helps power around 70% of the world's websites. Developers released emergency fixes on Wednesday, and cybersecurity authorities urged organisations to update affected systems immediately or take them offline until they were secured. The warning led governments, companies and major online services in several countries to temporarily switch off websites and other systems as a precaution.

How the flaws were found

Artificial intelligence played a role in the discovery. Security firm Calif identified one of the flaws in August during an audit of PHP funded by OpenAI, which said its GPT-5.6 Sol model was used in that research. Wiz, a cybersecurity company owned by Google, independently found and reported both vulnerabilities. The PHP security team rated each of them 9.2 on a 10-point severity scale.

The details were supposed to stay confidential while fixes were prepared, but information leaked out before the planned release, adding urgency to efforts to protect exposed systems. Researchers first saw little sign of widespread exploitation, yet attempted attacks have since been detected, raising concern that unpatched systems could be targeted. Amazon Threat Intelligence also spotted exploitation attempts, including some before the public disclosure.

Websites and services taken offline

The Wikimedia Foundation, which runs Wikipedia, deliberately took several supporting services offline while updates were installed and warned that users might experience disruption. France's Interior Ministry temporarily removed prefecture websites while patches were applied, and Germany's federal IT provider ITZBund shut down several government sites. German officials described the step as precautionary and said no security incidents had been identified. Government and public-service sites were also taken offline in countries including the Netherlands and Finland.

In the United Kingdom, the National Cyber Security Centre advised organisations using PHP to identify vulnerable systems, monitor them for suspicious activity and install security updates as soon as possible.