Government websites go offline across Europe after AI-found PHP flaws

Government websites in Europe and elsewhere went offline on Wednesday after the disclosure of critical vulnerabilities in the PHP programming language, Reuters reports. PHP's developers released urgent fixes and told all users they were "encouraged to update immediately," and cybersecurity agencies in Europe, Australia, Japan and Britain urged operators to patch or take sites offline until they could.

The flaws were found with AI. Wiz said its research relied on its Wiz Atlas vulnerability research tool together with Google's Gemini 4 Argon and OpenAI's GPT-5.6 Sol, and that the bugs had sat in the PHP codebase for more than a decade. OpenAI had earlier set out how the disclosure was coordinated.

In the Netherlands, the national cybersecurity agency took its own site offline as a precaution, and the Port of Rotterdam, the government portal Overheid.nl, the football association KNVB, the five largest political parties and several hospitals followed. Finland's state IT provider Valtori took government public network services offline, France's Interior Ministry put all its websites into preventive maintenance, and Danish municipal IT company Kombit shut down several services, including the national school communication platform. The Wikipedia operator also took down an unspecified number of systems, and Japan's prime minister, Sanae Takaichi, urged site owners on X to check whether they use PHP.

Tech firms warned that some hackers were already exploiting the flaws. Because the fix is now public and AI tools can reverse engineer the bug with little effort, experts told Reuters they expect a wave of intrusions. Costin Raiu of TLP:Black called it a "race to exploit." PHP underpins WordPress, Drupal, Joomla and Magento sites, and W3Techs estimates it runs about 75% of websites whose language can be identified. Small sites on shared hosting are most at risk of staying exposed, security experts said.