Global websites go dark after AI-discovered PHP flaws spark security scramble

New Zealand agencies urged to patch immediately as experts warn of a 'race to exploit'

By LineZotpaper

Published21 October 2026

Updated22 October 2026

Read Time2 min

Sources3 outlets

Government websites across Europe went offline on Thursday after developers of the PHP programming language released urgent fixes for critical vulnerabilities discovered with artificial intelligence. New Zealand's National Cyber Security Centre is urging organisations to apply the fix immediately and investigate any signs of unauthorised access, warning that some attackers are already exploiting the flaws.

Government websites across Europe went offline on Thursday after developers of the PHP programming language released urgent fixes for critical vulnerabilities that had sat undiscovered for years until they were found with artificial intelligence tools. Tech firms warned that some hackers were already exploiting the flaws, and experts said they expected a wave of intrusions because the fix is public and AI tools can reverse engineer the bug with little effort.

"AI was powering a 'race to exploit'," said Costin Raiu, co-founder of cybersecurity research and incident response firm TLP:Black. He said the next step was the "mass compromise of every vulnerable web server on the internet."

New Zealand's National Cyber Security Centre said it was aware of the incident and encouraged organisations to apply the recommended fix as soon as possible. It also urged them to investigate unauthorised access or compromise of the kind of commonly used website or web application affected by the threat.

PHP, a language dating to the early 1990s that originally stood for "Personal Home Page", underpins large parts of the public-facing web and is baked into WordPress, Drupal, Joomla and Magento sites. Tiffany Farriss, interim chief executive of the Drupal Association, said: "All servers using any version of PHP released in the last 20 years will be vulnerable. This issue impacts the majority of the Internet."

According to data from internet intelligence firm Censys, about 1.5 million of 2.6 million hosts report running a version of PHP for which there is no fix.

The Dutch cybersecurity agency took itself offline as a precaution, the operator of Wikipedia said it had taken down an unspecified number of systems until they could be safely patched, and the Internet Archive said it briefly went offline to deal with the issue.

The Dutch prime minister said he was closely monitoring the situation, while Japanese Prime Minister Sanae Takaichi posted on X that website owners should "check whether your live site uses PHP and prepare to apply the new fix."

Analysis

Why This Matters

PHP powers a large share of public-facing websites, including government and major platforms, so a critical flaw can force mass disruption and urgent patching.
The vulnerabilities were found with AI, and AI tools can reverse engineer them cheaply, shrinking the time between disclosure and exploitation.
New Zealand organisations must act quickly to patch or take systems offline to avoid compromise.

Background

PHP has been a staple of web development since the early 1990s and is embedded in widely used content management systems such as WordPress, Drupal, Joomla and Magento. That means a single critical vulnerability can have enormous knock-on consequences across governments, media and commerce. Past critical flaws in widely used software have shown that unpatched systems are quickly targeted, and the involvement of AI in both discovery and exploitation makes this episode especially fast-moving.

Key Perspectives

New Zealand National Cyber Security Centre: Encouraging organisations to apply the recommended fix as soon as possible and to investigate any signs of unauthorised access or compromise.

Security experts: Costin Raiu of TLP:Black describes an AI-powered "race to exploit" and warns of potential mass compromise of vulnerable web servers.

Site operators: The Dutch cybersecurity agency, Wikipedia and the Internet Archive took systems offline as a precaution until patches could be applied.

The PHP and Drupal communities: Tiffany Farriss of the Drupal Association warns the issue affects "the majority of the Internet" because nearly any PHP version from the last 20 years is vulnerable.

What to Watch

Whether the roughly 1.5 million hosts running unfixed PHP versions get patched before attackers exploit them at scale.
Early reports of intrusions at government or high-profile sites in the coming days.
Any additional PHP fixes or follow-up warnings from cybersecurity agencies.

Sources

Up to 70% of world’s websites at risk after AI discovers critical security flaw · Washington Examiner
Councils and NHS boards take websites offline after security alert · BBC Scotland
Warning for NZ as websites go dark around world in security scare · RNZ New Zealand Headlines

Checked

11 claims in this story checked against 1 source: 6 supported.

Show each claim

SupportedGlobal websites went dark after AI-discovered PHP flaws sparked a security scramble.RNZ New Zealand Headlines: “The websites in Europe and elsewhere went offline on Thursday (NZT) after the disclosure of critical vulnerabilities in a widely used programming language sent operators around the world scrambling”
Partly supportedGovernment websites across Europe went offline on Thursday after developers released urgent fixes.RNZ New Zealand Headlines: “government agencies across Europe were among those that took sites offline as a precaution.”
Partly supportedNew Zealand’s NCSC urged organisations to apply the fix immediately.RNZ New Zealand Headlines: “The National Cyber Security centre was encouraging New Zealand organisations to apply the recommended fix as soon as possible”
Partly supportedThe NCSC urged organisations to investigate any signs of unauthorised access.RNZ New Zealand Headlines: “The centre was also urging organisations to investigate unauthorised access, or compromise, of the kind of commonly used website or web application affected by the threat.”
Partly supportedThe NCSC warned that some attackers were already exploiting the flaws.RNZ New Zealand Headlines: “With tech firms warning some hackers were already exploiting the flaws, government agencies across Europe were among those that took sites offline as a precaution.”
Partly supportedExperts warned of a “race to exploit.”RNZ New Zealand Headlines: “AI was powering a "race to exploit," said Costin Raiu, co-founder of cybersecurity research and incident response firm TLP:Black.”
SupportedThe vulnerabilities had gone undiscovered for years until AI tools found them.RNZ New Zealand Headlines: “Developers of the PHP programming language on Thursday (NZT) released urgent new fixes to vulnerabilities that had quietly been lurking in their software for years until they were uncovered using AI”
SupportedExperts expected a wave of intrusions because the fix was public and AI tools could reverse-engineer the bug with little effort.RNZ New Zealand Headlines: “Because a fix is now public and artificial intelligence tools are able to reverse engineer the bug with little effort, experts said they were bracing for a wave of intrusions”
SupportedRaiu said the next step was the “mass compromise of every vulnerable web server on the internet.”RNZ New Zealand Headlines: “He said the next step was the "mass compromise of every vulnerable web server on the internet."”
SupportedTiffany Farriss said all servers using any PHP version released in the last 20 years would be vulnerable, and that the issue affected the majority of the internet.RNZ New Zealand Headlines: “"All servers using any version of PHP released in the last 20 years will be vulnerable," said Tiffany Farriss, the interim chief executive of the Drupal Association. "This issue impacts the majority of the Internet."”
SupportedAbout 1.5 million of 2.6 million hosts reported running a PHP version with no fix.RNZ New Zealand Headlines: “According to data from Censys, the internet intelligence firm, about 1.5 million out of 2.6 million hosts report running a version of PHP for which there is no fix.”