AI-Uncovered PHP Flaw Sends Governments Scrambling to Take Websites Offline

A set of critical vulnerabilities in PHP, one of the most widely used programming languages for building websites, sent government agencies and companies scrambling this week after the flaws were uncovered with the help of artificial intelligence tools. PHP's developers released urgent fixes, saying users were "encouraged to update immediately," while cybersecurity officials warned that hackers were already exploiting the bugs before most systems could be patched.

Agencies urge sites offline as a precaution

Government cybersecurity agencies in the US, UK, Canada, Australia and the European Union urged website operators to take affected sites offline until their PHP installations could be updated. Some governments acted immediately: Finland and the Dutch House of Representatives both disconnected their websites from the internet as a precaution while patches were applied.

The episode highlights a newer risk in software security: once a vulnerability and its fix become public, AI tools can reverse-engineer the underlying flaw with little effort, giving attackers a head start on exploiting systems that haven't yet updated. Security researchers said they expect a wave of intrusion attempts targeting unpatched PHP installations in the days ahead, since PHP underpins a large share of the web's backend infrastructure, including many government and enterprise sites.