Governments and companies around the world shut down websites on Thursday as they raced to protect themselves from hacks.
The rush followed the discovery of critical flaws in PHP, a programming language used by a large share of the world’s websites.
Cybersecurity firm Wiz estimated that PHP code helps run about 70% of websites, from online stores and news outlets to government services.
It called the flaws “among the most severe vulnerabilities discovered in PHP, and arguably in software history.”
PHP programmers released a fix on Wednesday. The US National Security Agency told organisations to patch their sites immediately or pull vulnerable systems offline.
What the Flaws Allow
Only sites that run PHP on their own servers are exposed. Many large platforms use other languages or could install the fix quickly and stayed online.
Rahat Masood, senior lecturer in cybersecurity at the University of New South Wales, Sydney, called the discovery “quite devastating.”
She said it could allow “attackers to get into your servers without any authorisation, without any username or password.”
“Once they are in the servers, they can do anything they want,” she said, from stealing data to changing website content. She asked institutions to “take it seriously.”
Powerful AI models can now spot weak points in code that humans missed for decades. The number of software vulnerabilities found worldwide in 2026 is on track to roughly double last year’s record.
Sites Go Dark
Government sites in countries from Australia to the Netherlands went offline. Insurance firms, transport operators and media outlets ran emergency maintenance.
Japan’s prime minister advised businesses to act “with great urgency,” and South Korea told tech departments to update their software.
“If you run PHP, it is imperative that you update now,” the PHP Foundation said in a blog post.
Security engineer Volker Dusch told the Wall Street Journal it was PHP’s most serious problem in over a decade, comparing it to Heartbleed in 2014.
Security firm Calif found the flaws in August using OpenAI’s GPT-5.6 Sol model, as part of an OpenAI-funded audit. OpenAI said the flaws were “one of the most impactful vulnerabilities in recent memory.”
Wiz found them independently weeks later using AI models including Google’s Gemini 4 Argon.
In France, local government sites, including one for the Paris police, were made inaccessible at the request of the national cybersecurity agency.
The Wikimedia Foundation warned of outages on Wikipedia and took many services offline until they were patched.
