Government agencies, major companies and online platforms across several countries temporarily shut down websites. They suspended digital services after researchers uncovered critical security vulnerabilities in PHP, a programming language used by an estimated 70 per cent of websites worldwide.
The flaws, collectively known as PHP2Shell, could enable attackers to execute malicious code remotely, disrupt online services and access sensitive information, including data that may contain passwords, according to cybersecurity researchers and web infrastructure provider Cloudflare.
The United States National Security Agency and Europe’s cybersecurity agency issued warnings on Wednesday, urging organizations to take immediate steps to address the vulnerabilities.
The PHP Foundation, which supports the development of the programming language, released security patches and called on website operators to update affected systems without delay.
PHP is widely used to build and operate websites, including platforms powered by WordPress and Drupal. The vulnerabilities had remained undetected for years before researchers used advanced artificial intelligence tools to identify and demonstrate how they could be exploited.
The discovery has intensified concerns about the growing ability of AI to accelerate both cybersecurity research and potential cyberattacks.
Companies and governments suspend services
Organizations in Europe and Asia were among those that temporarily took websites or services offline while applying security measures.
The Journal, Ireland’s second most-used online news source after national broadcaster RTÉ, was temporarily unavailable on Thursday morning as its operators strengthened its defences.
In Japan, airline All Nippon Airways, railway operator JR West and major lender Mitsubishi UFJ Financial Group reported temporary suspensions affecting some webpages or services.
Government websites in France, Denmark, Finland and the Netherlands also went offline temporarily while security updates were implemented. The affected Dutch systems included the country’s cybersecurity agency.
The Wikimedia Foundation, the non-profit organization behind Wikipedia, said it was addressing the vulnerabilities and had taken some systems offline as a precaution.
Dutch Prime Minister Rob Jetten said his government was closely monitoring the situation. Japanese Prime Minister Sanae Takaichi also urged companies to check whether their public-facing websites used PHP and prepare to install the security fixes as soon as possible.
Takaichi said organisations should consider suspending services where necessary to reduce their exposure to potential attacks.
AI accelerates discovery of longstanding flaws
The vulnerabilities were identified by researchers working with OpenAI, Google-owned cybersecurity firm Wiz and another security company, Calif. The findings were made public on Wednesday after the PHP Foundation had developed a fix.
Wiz said artificial intelligence had helped researchers uncover weaknesses that had remained hidden in PHP’s codebase for more than a decade, describing the discovery as a potential turning point in cybersecurity.
The company said AI models and supporting tools enabled a researcher to complete work in about a week that could previously have taken a highly experienced team months.
Researchers used Google’s Gemini 4 Argon, Wiz Atlas and OpenAI’s GPT-5.6 Sol during the investigation.
The key development was not simply identifying the flaws, but demonstrating how they could be turned into working exploits. Such capabilities could help security teams identify and repair weaknesses faster, but they could also lower the technical barriers for malicious actors seeking to exploit vulnerable systems.
According to Cloudflare, the flaws could allow unauthorized code execution, service disruption and exposure of customer information.
Comparisons with Heartbleed
Cybersecurity researchers have compared PHP2Shell with the Heartbleed vulnerability discovered in 2014, which affected OpenSSL, a widely used technology for securing internet communications.
Heartbleed exposed sensitive information that should have remained protected, raising global concerns about the security of online systems.
Wiz researchers said PHP2Shell could prove similarly significant because the underlying weaknesses had existed for years, but advances in AI made it easier to demonstrate how they could be exploited.
The episode highlights a growing challenge for organizations that depend on widely used software: vulnerabilities can remain hidden for long periods, while advances in AI can rapidly change how easily attackers or researchers can identify and exploit them.
Although the PHP Foundation has released patches, website operators still need to update affected systems and verify that their security measures are effective.
The incident has also sharpened debate among governments and technology companies over how to manage increasingly capable AI systems, which can strengthen digital defences while potentially making sophisticated cyberattacks easier to develop.
