Millions of websites have been impacted by a cyber security crisis that has been lingering undetected for more than a decade.
Governments and companies around the world are currently racing to update their systems to prevent catastrophic attacks from hackers, with many choosing to take down their sites altogether while they try to fix the issue.
It all stems from a programming language called PHP, which first launched in 1995 and has been used to build websites since the early 2000s. Two major security flaws were discovered by artificial intelligence agents, and now hackers are trying to use AI tools to exploit them in record time.
OpenAI has called it “one of the most impactful security issues in recent memory”, while researchers at the Google-owned security firm Wiz that found the flaws said it ranked “among the most severe vulnerabilities discovered in PHP, and arguably in software history”.
So what actually happened and why is it so significant?
What is PHP?
Behind the scenes, PHP powers websites by assembling page content on the server and sending the finished page to a browser.
It is free, open source and maintained by volunteers, with site owners rarely interacting with it directly.
According to web technology tracker W3Techs, PHP runs nearly 70 per cent of websites whose programming language can be identified.
It is the engine behind WordPress, the software that powers about 40 per cent of all websites such as blogs, small business pages, government portals, online shops and news sites.
What are the risks of the PHP flaws?
The two vulnerabilities are rated 9.2 out of 10 on the CVSS v4.0 severity scale, a standard industry scoring system.
CERT-EU, the European Union's cybersecurity response team, said that rating signals unauthenticated remote code execution, meaning an attacker can run commands on a vulnerable server over the internet with no password or account.
A single flaw in PHP opens the same door on millions of servers at once. Whoever exploits the flaw controls the website.
GoDaddy, a web hosting provider, said that could mean stolen data, defaced pages or full-system compromise. Cloudflare's chief technology officer said early attacks were emerging.
Most small websites are typically run by owners with no security staff, often on shared hosting where they do not manage the server and may not know who updates PHP.
Wordfence, a security plugin for WordPress sites, warned that the usual automatic updates will not apply this fix. CERT-EU's guidance is to take affected sites offline rather than leave them exposed.
How were the flaws found?
Researchers at security firm Calif, working with OpenAI, reported the first flaw to PHP on 11 August after finding it with OpenAI's GPT-5.6 Sol model, the company said.
Wiz, a security firm owned by Alphabet's Google, found the flaws independently and reported a second one on 24 August, also using AI models.
Wiz said the findings "rank among the most severe vulnerabilities discovered in PHP, and arguably in software history."
The underlying flaws had been present for decades, the firm said, but proving they were exploitable required a chain of steps "at the edge of what human researchers could practically achieve."
US President Donald Trump's administration said it was "tracking and coordinating with federal agencies and leading SI labs to expedite the release of the fix," referring to Trump's preferred name for artificial intelligence.
It framed the discovery as evidence that American "Super Intelligence" strengthens national security.
Who was impacted?
A UK minister confirmed on Thursday that 32 government services are offline and four are partially unavailable as a result of the PHP security flaw. Downing Street said no major public-facing critical services have been impacted.
The government websites of multiple European nations were also taken offline on Wednesday as administrators scrambled to address two critical security flaws in PHP – one of the internet’s most prevalent programming languages.
After PHP’s developers announced patches for the vulnerabilities on Wednesday, EU cyber security officials advised organisations to take affected sites offline if the fixes could not be applied immediately.
According to Cloudflare, which is used by millions of websites to protect against cyber attacks, nearly 70 per cent of all websites were impacted.
CEO Matthew Prince also revealed that millions of hacking attempts had been made since the exploits were shared.
“In the 10 hours before it was publicly announced, across the Cloudflare network we saw thousands of attempts to exploit it,” he said. “That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.”
Additional reporting by agencies.
Read MoreUK govt hit as millions of websites taken down over cyber security threat – live
