Serious security flaws revealed: Countries around the world shut down websites

Government agencies and private enterprises across multiple continents took websites offline on Wednesday following the disclosure of two critical security vulnerabilities in PHP, a programming language that supports a substantial portion of the global web infrastructure. The immediate shutdown of digital services occurred after details regarding the flaws leaked publicly on Tuesday, prompting emergency defensive measures before the official release of a patch. The vulnerabilities allow attackers to gain unauthorized access to server files or databases and execute remote code without authentication, posing a severe threat to systems ranging from online retail stores and news portals to essential state services. The US National Security Agency issued a rare public directive urging organizations to either patch vulnerable systems immediately or remove them from the network. In a statement posted on the social media platform X, the agency noted that the defects frequently provide a direct pathway to a server’s file system or database. Attackers could exploit these gaps to seize control of web servers without requiring passwords. The NSA advised all entities using PHP to prepare for an update addressing the two critical vulnerabilities effective immediately. Other bodies, including the European Union’s Computer Emergency Response Team and the UK’s National Cyber Security Centre, issued similar alerts recommending the identification of affected systems and the installation of updates. Spain’s national cybersecurity institute, Incibe, classified the severity of the flaws at 9.2 on a scale of ten, its highest level of importance. The vulnerabilities, collectively referred to as PHP2Shell, were identified with the assistance of advanced artificial intelligence models. Security firm Calif discovered the initial flaw in August during an audit of PHP code financed by OpenAI, utilizing the company’s GPT-5.6 Sol model. Weeks later, Wiz, a security company owned by Alphabet, independently identified additional deficiencies using AI tools, including Google’s Gemini 4 Argon and GPT-5.6 Sol. Wiz estimated that PHP powers approximately 70 percent of websites worldwide. The firm described the discoveries as ranking among the most severe vulnerabilities found in PHP, and arguably in software history. Although the underlying code flaws had existed for decades, Wiz stated that proving their exploitability required a complex sequence of steps near the limit of what human researchers could practically achieve. Volunteers maintaining the PHP language released a fix on Wednesday. The PHP Foundation, a nonprofit organization that funds developers working on the language, urged users to update their systems immediately. On its blog, the foundation stated that updating is imperative for anyone running PHP. Volker Dusch, a security engineer at the PHP Foundation, told the Wall Street Journal that this represents the most serious issue PHP has faced in over a decade. He compared the situation to Heartbleed, a 2014 security error that triggered a global race to patch systems. The leak of technical details on Tuesday accelerated the crisis response. Prior to the leak, the developers had been notified confidentially, and information remained secret while the patch was being developed. The premature exposure forced governments to act preemptively. In France, the Ministry of the Interior announced that local government websites, including the Paris police site, became inaccessible on Wednesday afternoon at the request of the French National Cybersecurity Agency. In the Netherlands, the national digital identity service DigiD, the website of the House of Representatives, and even the site of the National Cyber Security Center were taken offline as a precaution, according to the Dutch public broadcaster NOS. Germany’s Federal Ministry for Digital Transformation and Government Modernization confirmed it had taken certain websites offline as a preventive measure. The German Federal Office for Information Security warned that the vulnerabilities posed a threat to web applications globally. Reports indicated that numerous public administrations, universities, and hospitals in Germany removed their pages from the internet. In Belgium, the Foreign Ministry temporarily disabled its websites, though the national cybersecurity center reported no recorded attacks on Belgian sites. The Czech government also suspended its websites to implement protective measures. In Australia, the Signals Directorate acknowledged that its cyber.gov.au site was among the government pages affected by the flaws. Japan’s Prime Minister Sanae Takaichi posted on social media to warn citizens about the PHP risk. Authorities in Finland also confirmed they had shut down specific websites to apply the security patch. The incident highlights a broader trend in software security, where increasingly capable AI models are uncovering vulnerabilities at a rapid rate. The number of vulnerabilities discovered in 2026 is projected to be roughly double the record total from the previous year. OpenAI characterized the bug as one of the most impactful vulnerabilities in recent memory, stating it marks a new phase where AI can identify security bugs with internet-scale impact. Ethan Mollick, a professor at the Wharton School of the University of Pennsylvania who studies artificial intelligence, observed that companies are struggling to keep pace with the speed required to install security patches against AI-driven cyberattacks. He noted that consumers will likely face frequent and urgent demands for system updates in the future. The widespread reliance on PHP means the potential impact extends far beyond government sectors, affecting commercial entities and individual users who rely on the language for their digital presence. The coordinated global response underscores the critical nature of the flaws and the growing role of automated tools in both discovering and exploiting software weaknesses.