Several government and public service websites in Europe were taken offline on October 21 after two serious security breaches were found in PHP, the programming language used to build many websites. Authorities took the affected systems offline as a precaution while developers worked to fix the vulnerabilities and prevent possible attacks, Reuters reported.
The vulnerabilities had gone undetected for years and were discovered with the help of AI tools, raising concerns about how quickly hackers could exploit them. While AI is helping cybersecurity researchers find flaws in widely used software, the same technology could also help attackers target systems that have not yet been updated. Reuters reported that some companies had already detected early signs of attacks, prompting security teams to move quickly to protect vulnerable websites.
What Are The PHP Security Flaws?
PHP is a programming language used to build and run websites. It operates behind the scenes on platforms including WordPress, Drupal, Joomla and Magento. According to Reuters, the two vulnerabilities received a severity score of 9.2 out of 10 under the CVSS 4.0 system. The flaws could allow unauthenticated remote code execution, meaning an attacker could run commands on a vulnerable server without first logging into an account.
The consequences could include stolen information, altered webpages or a complete compromise of an affected system. PHP developers released security fixes on October 21 and urged users to update immediately. CERT EU, the European Union's cybersecurity response team, advised organisations unable to apply the fixes to take affected websites offline.
ALSO READ: NDTV World Summit 2026: Swami Sarvapriyananda Recounts Late-Night Exchange With Claude, ChatGPT
How AI Helped Discover The Vulnerabilities
The vulnerabilities were uncovered independently by cybersecurity firms Calif and Wiz using artificial intelligence tools. Calif said it discovered one flaw with the help of OpenAI's GPT 5.6 Sol model. Wiz separately identified another vulnerability using its AI research tools alongside models from Google and OpenAI. According to Reuters, the weaknesses had remained hidden in PHP's code for more than a decade. Researchers said AI helped automate complicated analysis that would have been difficult and time consuming to carry out manually.
Which Websites Were Affected?
The Netherlands, France, Finland, Germany and other European countries reported disruptions to government or public services. In the Netherlands, affected organisations included the government portal Overheid.nl and several hospital websites. Finland's state IT services provider also took public web services offline as a precaution.
Reuters reported that Wikipedia's operator and the Internet Archive also temporarily took some systems offline while addressing the vulnerabilities. Not every outage indicated a successful cyberattack, with several organisations saying their shutdowns were preventive.
What Happens Next?
The immediate priority is for website operators to install the security fixes and check their systems for signs of compromise. The episode also demonstrates how AI is changing cybersecurity on both sides, helping researchers detect weaknesses while potentially accelerating attempts to exploit them.
The PHP incident is a reminder that a vulnerability in widely used software can have consequences far beyond a single website. As AI makes security research faster, the time between discovering a weakness and attackers attempting to exploit it could shrink, leaving organisations with less room for delay.
ALSO READ: ChatGPT Gets Locked Chats To Keep Private Conversations Away From Prying Eyes
Also Read | Layoffs Are Rising In Tech, But These Skills Are Helping People Unlock Better Pay
Essential Business Intelligence, Sharp Market Insights, Practical Personal Finance Advice, Daily Fuel, Gold and Silver Prices and Latest Stories — On NDTV Profit.
