Government agencies and companies around the world have taken their websites offline after two serious security flaws were discovered in PHP, the programming language on which a large part of the internet is based. PHP sits behind popular website-building platforms, and the weaknesses could affect a vast number of sites — from online shops and news portals to government services.
Security firm Wiz, owned by Google, is one of the companies that identified the problems. It estimated that PHP powers around 70 per cent of the world's websites and that the deficiencies rank among the most serious security flaws discovered in PHP, and likely in software history. The US National Security Agency (NSA) told organisations to immediately patch vulnerable systems or remove them from the network. The NSA stated that the flaws often allow direct access to server files or databases, and attackers could exploit them to take control of web servers without needing a password.
Volker Dusch, a security engineer at the PHP Foundation, told the Wall Street Journal that this was the most serious problem PHP had faced in more than a decade. He compared it to Heartbleed, the 2014 security error that triggered a global race to fix vulnerabilities. According to available data, the number of vulnerabilities discovered in 2026 could be roughly double last year's record figure.
Volunteers working on PHP have released a fix, and the PHP Foundation, the organisation that funds developers working on the language, stated on its blog: "If you use PHP, it is essential that you update it immediately." Security firm Calif discovered the flaws in August using OpenAI's GPT-5.6 Sol model, with the PHP code review funded by OpenAI. Wiz announced that several weeks later it had independently identified further flaws with the help of artificial intelligence models, including Google's Gemini 4 Argon and GPT-5.6 Sol.
OpenAI posted on the platform X that it considers the error one of the most impactful security vulnerabilities in recent times, marking a new phase in which artificial intelligence can find security flaws affecting the internet as a whole. Ethan Mollick, a professor at the Wharton School of the University of Pennsylvania who studies artificial intelligence, said that companies he speaks to are struggling to keep up with the pace at which they must install security patches to protect themselves against AI-assisted cyberattacks.
PHP developers were informed of the security flaws confidentially, and details were kept secret while a fix was being prepared. However, they leaked onto the internet a day before the scheduled release of the patch, prompting a rush to take websites offline. In France, local government websites, including that of the Paris police, are inaccessible, the interior ministry said, at the request of the French National Cybersecurity Agency.
In the Netherlands, the national digital identity service DigiD, the website of the House of Representatives and the site of the National Cyber Security Centre were taken offline as a precaution, Dutch public broadcaster NOS reported. The Belgian foreign ministry temporarily took its websites offline, according to a post on the platform X, while the Cyber Security Centre recorded no attacks on Belgian websites. The Czech government also temporarily took its sites offline to implement protective measures. The Australian Signals Directorate announced that its site cyber.gov.au was among the government websites affected by the security flaws, Australian public broadcaster ABC reported.
