Government and company websites around the world briefly went dark and suspended some services, as operators scrambled to patch their systems after artificial intelligence helped find critical vulnerabilities in a widely used programming language.
Nearly three dozen UK government services are unavailable and four are “partially unavailable” while security upgrades take place, UK government minister Elizabeth Lloyd told the House of Lords Thursday. “No large public-facing critical services are being affected by the exercise but some limited services may temporarily be offline while security work is carried out,” a UK government spokesperson told reporters.
The US National Security Agenc y and Europe’s cybersecurity agency have advised companies to take immediate action to address two critical flaws in PHP, a programming language that powers 70% of all websites in the world, including WordPress and Drupal, an open-source content management system.
The PHP Foundation, the organization behind the coding language, has released a patch for the bugs, which have been hidden in their software for years, and is urging website operators to update their systems immediately.
Popular Irish news website The Journal was temporarily offline Thursday morning while it bolstered its “defences,” it said in a notice. The Journal is Ireland’s second most-used online news source, behind only RTÉ, the national broadcaster, according to the Reuters Institute.
The flaws in PHP – which originally stood for Personal Home Page – were uncovered by teams at OpenAI , Google-owned cybersecurity company Wiz, and another cybersecurity company, Calif . The bugs, collectively called PHP2Shell, could allow attackers to hack into websites and read memory that could contain sensitive information, like passwords.
“With PHP behind such a vast share of the web, the exposure could reach almost everywhere people spend money online,” said Nigel Green, the CEO of deVere Group, a financial advisory firm.
“Booking platforms, marketplaces, subscription services, ticketing sites, delivery apps and utility portals could all be holding card details on systems built with the same kind of code,” he added.
Even world leaders urged organizations to take action. Dutch Prime Minister Rob Jetten said that his cabinet was “closely monitoring the situation surrounding the vulnerabilities in PHP.”
Japan’s Prime Minister Sanae Takaichi said companies should consider suspending services if necessary in order to reduce their exposure. “Please check if your publicly available websites use PHP, and prepare to apply the fix patch that will be released tonight… as soon as possible,” she posted on X Wednesday.
Japanese airline ANA, railway operator JR West and the country’s largest bank, MUFG, were among companies that reported some webpages and services temporarily suspended.
In Europe, government websites in France, Denmark, Finland and the Netherlands, including the Dutch cyber security agency, were temporarily taken offline while security fixes were implemented.
The Wikimedia Foundation, the non-profit that operates Wikipedia, told CNN Thursday that it was “in the process of addressing security vulnerabilities in PHP,” and that a number of its systems had been taken down as a “precautionary measure.”
AI played a crucial role in finding and fixing vulnerabilities “that had remained hidden in the PHP codebase for more than a decade,” according to Wiz, which said the episode marks an “AI inflection point.”
“What AI changed was the ability to understand the weaknesses and turn them into a working exploit,” Wiz researchers wrote in a blog post Wednesday in which they described PHP as a “backbone of the web.”
“With frontier AI models and the right tools, a single researcher completed in a week what previously would have taken a world-class team months of work,” they added.
The bugs were discovered in late August but were disclosed to the public only on Wednesday, after PHP had come up with a fix.
The flaws could allow attackers to remotely execute code, disrupt services and expose customer data, according to web infrastructure provider Cloudflare, which has been working with the PHP Foundation, Calif, OpenAI and Wiz to address the issue.
Researchers at Wiz used Google’s Gemini 4 Argon, Wiz Atlas and OpenAI’s GPT-5.6 Sol during the research process.
Wiz researchers say the issue is on par with the Heartbleed bug from 2014, which impacted an encryption technology estimated to be used by two-thirds of the Web. Heartbleed allowed cybercriminals to access data that should have been protected.
Like Heartbleed, the researchers at Wiz say PHP2Shell could similarly serve as a turning point in cybersecurity. While the vulnerabilities existed for years, AI made it practical to deploy them.
“The underlying flaws had been present for decades, but demonstrating their exploitability required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve,” the researchers said.
“Frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit.”
– CNN’s John Liu, Anna Cooban, Amy Croffey and James Frater contributed reporting.
