AI uncovers decade-old vulnerabilities, leaving website operators scrambling
Emergency shutdowns across several European countries followed the disclosure of critical vulnerabilities in PHP, a programming language used by much of the web.
A cybersecurity discovery has left website operators facing a difficult choice: take services offline or risk leaving them exposed to hackers. Government agencies and other organizations across Europe suspended online services on Wednesday after critical vulnerabilities were disclosed in PHP, a programming language used across much of the internet.
The flaws had remained hidden for years before researchers uncovered them with the help of artificial intelligence. Developers released emergency patches on Wednesday, but security experts warned that the public disclosure could give attackers a shortcut to exploiting systems that had yet to be updated.
The potential exposure is substantial. Internet intelligence firm Censys identified about 2.6 million hosts reporting PHP use, of which roughly 1.5 million were running versions for which no fix was available. PHP powers approximately 75% of websites whose programming language can be identified, according to web technology tracker W3Techs.
The response has already disrupted public services. The Netherlands’ National Cyber Security Centre took its own website offline as a precaution, followed by other organizations, including the Port of Rotterdam, the Overheid.nl government portal, the national soccer association KNVB, websites belonging to the country’s five largest political parties and several hospitals.
Finland’s state IT services provider Valtori suspended government public network services, while Danish municipal IT company Kombit shut down several services, including the national school communication platform. France’s Interior Ministry placed all its websites into preventive maintenance.
The operator of Wikipedia said it had taken an unspecified number of systems offline until they could be patched safely. The Internet Archive also reported a brief shutdown as it addressed the vulnerabilities. Automattic, which operates WordPress.com and Tumblr, said its hosted services were protected.
The shutdowns reflect concern that the time available to defend vulnerable systems could be shrinking. Once technical details and fixes become public, attackers can study the changes to work out how the underlying flaws operate. AI tools may make that process faster and easier to scale.
AI was driving a “race to exploit,” said Costin Raiu, co-founder of cybersecurity research and incident response firm TLP. He warned that the next stage could be the “mass compromise of every vulnerable web server on the internet.”
Two cybersecurity companies said they independently identified the PHP vulnerabilities with the help of AI. Calif said it discovered the flaws on August 1 using a large language model and had been working on a fix since then.
Wiz, the cybersecurity company owned by Google parent Alphabet, said it used its autonomous AI vulnerability research tool, Wiz Atlas, along with Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol.
Wiz said the vulnerabilities had remained hidden in PHP’s codebase for more than a decade and would have been extraordinarily difficult for a human hacker to exploit.
“Pre-AI, this manual work would be difficult to implement and even harder to scale,” the company said in a blog post. “With AI, this is no longer a barrier.”
Calif and Wiz said they coordinated with each other, the PHP development team and OpenAI on the discovery.
The vulnerabilities were not merely a theoretical concern by the time they became public. Amazon security chief CJ Moses said the company’s security team detected an attempted exploit against one of its decoy systems, known as a honeypot, on October 17, four days before public disclosure.
The attempt came from an anonymous internet address, suggesting that a threat actor was responsible, Moses wrote in a blog post late Wednesday. Amazon did not know how the actor had learned about the vulnerabilities while the details remained under embargo.
Multiple actors made further attempts on Wednesday before the embargo was lifted, according to Amazon. The company said it was unclear whether those attempts would have succeeded against real websites, but warned that the flaws were “now being broadly exploited in the wild.”
The White House said it had been made aware of the vulnerability on Friday.
PHP dates back to the early 1990s, when its name stood for “Personal Home Page.” The free, open-source language is maintained by volunteers and is embedded in a broad range of web infrastructure, including sites built with WordPress, Drupal, Joomla and Magento.
When a visitor opens a PHP-powered website, the server executes the code needed to assemble the page and deliver it to the browser. A weakness in that underlying software can therefore affect many different websites, rather than a single application or service.
“This issue impacts the majority of the internet,” said Tiffany Farriss, interim chief executive of the Drupal Association. She said servers using PHP versions released over the past 20 years would be vulnerable.
Cybersecurity agencies have urged operators to install the available patches immediately or take affected websites offline until they can be secured. The practical challenge is particularly acute for smaller organizations and individuals that lack dedicated technical teams.
Websites running on shared hosting services may be especially difficult for their operators to secure because customers do not directly control the underlying servers. Automattic said users of its hosted WordPress.com solutions and Tumblr were protected against the bug, but that assurance does not extend automatically to every independently hosted PHP website.
Lukasz Olejnik, a visiting senior research fellow at King’s College London, said AI-assisted hacking campaigns had proliferated in recent weeks.
“The scale is huge, and with AI, exploitation may happen instantly,” Olejnik said.
The incident has also drawn attention from political leaders. Dutch Prime Minister Dick Schoof said he was monitoring the situation, while Japanese Prime Minister Sanae Takaichi urged website owners on X to check whether their live sites used PHP and prepare to apply the fix.
The broader concern extends beyond PHP itself. AI is making it easier for researchers to identify weaknesses in widely deployed software, potentially improving security by bringing hidden flaws to light. But once those weaknesses are disclosed, attackers can use similar tools to understand them and develop exploits.
Reuters contributed to this report.
