Governments and companies around the world have been patching systems, and in some cases taking websites offline, after two serious flaws were found in a programming language called PHP. 

What is happening?

According to Wiz Research, one of the firms that found the flaws, PHP helps run about 70% of the world's websites. It is an open-source scripting language that has been in use for more than 30 years. 

When you visit a site like Wikipedia, PHP is the code that collects the information you asked for and presents it in a readable form. It also sits underneath publishing platforms such as WordPress and Drupal.

The two flaws sit in parts of PHP that nearly every request touches: memory management and error handling. The US National Security Agency says they can be used to launch an attack that provides a "direct path" to a server's file system or database. Cybersecurity lecturer Rahat Masood of the University of New South Wales told reporters that attackers could get into servers "without any username or password."

The flaws were found with the help of artificial intelligence. Security firm Calif found them in August using an OpenAI model, as part of an OpenAI-funded audit of PHP's code. Wiz found them independently weeks later, using AI models including Google's Gemini. Both reported them privately to PHP's developers, and a fix was being prepared in secret, but the details leaked. 

According to the PHP Foundation, they began circulating on forums and social media on Tuesday, ahead of the planned disclosure, so the developers brought it forward and released the fix on Wednesday.

A security engineer at the foundation told the Wall Street Journal it was the most serious problem PHP had faced in more than a decade. He compared it to Heartbleed, a 2014 flaw that set off a worldwide rush to patch.

Who is being affected?

Only websites that run PHP on their own servers are exposed. Many large platforms are built on other languages, or are run by operators who could install the fix quickly and stayed online.

Even so, the disruption has been wide.

Websites in countries from Australia to Finland and the Netherlands went dark. Finland's government took down public web services, and so did the Netherlands' cyber-security agency. Edinburgh council and a number of Scottish councils and health boards took sites offline.

In the UK, 32 government services are unavailable and four are partially unavailable, Baroness Lloyd of Effra has confirmed in the House of Lords.

The BBC took some sites and pages offline. The foundation behind Wikipedia took down some systems and warned of possible outages. A Pokemon sleep tracker was briefly taken offline.

In Japan, Nomura, Mitsubishi UFJ, ANA and East Japan Railway suspended some online services. The ministry of finance and the meteorological agency partly suspended services, and the national tax agency took down one of its services.

France's telecommunications company Orange suspended access to certain PHP-based websites and applications across several subsidiaries.

Drupal, which is reportedly used by many governments, is also affected. In Australia, 391 government websites run on a Drupal-based platform called GovCMS.

Smaller organizations may be the most exposed, with experts warning that sites with limited security resources, including user-run blogs, are at greater risk.

What could go wrong?

Masood said that once attackers are inside a server, "they can do anything they want," from stealing sensitive information to changing website content. 

Steve Kerrison, a cybersecurity lecturer at James Cook University, warned that poorly maintained blogs could be used to spread computer viruses, send spam or distribute malicious content.

The attackers moved quickly - global web infrastructure and cybersecurity company Cloudflare’s chief executive said the company saw thousands of attempts to exploit the flaw in the 10 hours before the announcement. That rose to tens of thousands within 45 minutes of it, hundreds of thousands within two hours, and millions soon after. 

Amazon said it was targeted in attempts days before the public disclosure, and it is not clear how the attackers knew about the flaw.

The picture on actual damage is mixed. Security firm Hadrian said it was seeing "exploitation happening at scale." 

There has been little evidence so far of damaging attacks, and Finland’s state IT provider said it was not aware of any active exploitation of the flaws. 

Kerrison said any data stolen could fuel a wave of phishing attacks later, in which hackers use personal details to steal passwords.

The episode also shows how AI cuts both ways. OpenAI said it "marks a new phase, where AI can find security bugs with internet-scale impact," but also that AI can help attackers rapidly develop tools to exploit them. 

Kerrison said fear of hackers using AI to exploit the flaws quickly was a driver of the urgent response.

What is being done to contain the issue?

The main fix is a patch, which PHP's developers released on Wednesday. The PHP Foundation said: "If you run PHP, it is imperative that you update now."

Governments and agencies have backed that call.

In the US, NSA told organizations to patch immediately or take vulnerable systems offline. The UK's National Cyber Security Centre gave similar advice and told organizations to check for "backdoors" installed by an attacker. Counterparts in the EU, Singapore and Australia issued similar alerts.

Japan's Prime Minister Sanae Takaichi urged people to check whether their public websites run PHP, and said temporarily suspending a site could be an effective way to reduce risk if patching is difficult.

China's industry ministry urged organizations to inspect systems and upgrade, and recommended changing accounts, passwords and keys where necessary.

South Korea raised its private-sector cybersecurity alert level.

Taking a site offline is a deliberate trade-off. As Hadrian put it, "Shutting down a service for a few hours costs far less than a compromised server."

Restoring services takes time. Finland's Valtori said it was gradually lifting its precautionary blocks, but that restoring services "can take days or even weeks," because systems must be tested as well as updated. 

OpenAI said it had released a program to check whether PHP-based platforms are secure.

Should I worry?

For most people, the responsibility lies mainly with website operators, according to Salil Kanhere of UNSW Sydney. The patch itself is a small, routine fix for most tech teams, according to Paul Spain of Gorilla Cyber Security.

As an ordinary user, the sensible approach is to stay alert rather than alarmed. Kanhere advises watching for security advice from affected services, such as requests to change your password, and being wary of phishing messages that exploit the publicity around the incident.

If you run a website, the concern is more direct. 

Sigi Goode, a professor at the Australian National University, said the sites that went down to fix the problem are not the worry. 

"The bigger concern is the websites that are not down today," he said, adding that users should be wary of them. Kerrison warned that some sites and people "will have no idea about this and still won’t for days, weeks and months."

What happens next?

Don Smith of Sophos said the challenge is "not simply installing a patch, but finding and managing every instance where PHP is running."

He also advised organizations to monitor PHP and web-server processes for unusual activity or command execution, which could mean an attacker is already inside. The NSA urged "heightened awareness" in the coming weeks and close attention to updates from software vendors.

Further attacks are likely. Kanhere said more attempts to exploit the flaws are expected in the coming weeks now that the technical details are public.

The number of software vulnerabilities found worldwide in 2026 is on track to roughly double last year’s record, as AI models spot weaknesses in code that humans missed for years. Kanhere said the bugs themselves were not new. "What changed was our ability to find them."

Ryan Ko of the University of Queensland said many flaws stem from software built for functionality rather than security.

The PHP Foundation, which maintains the language, runs on financial contributions and has 13 full-time and part-time engineers. Microsoft chief executive Satya Nadella, speaking in Cologne, said the episode underscored the importance of building digital systems that can be maintained securely.