PHP vulnerability found with AI takes government websites offline across Europe

A PHP vulnerability found with the help of AI sent governments across Europe scrambling on Wednesday. PHP, the programming language behind a large share of the web, released emergency fixes for two critical flaws that let an attacker run code on a web server without logging in, its security advisory says. Both are rated 9.2 out of 10 for severity, according to the project’s own advisory.

The scale is what alarmed officials. PHP is used by 69.3% of all websites whose server-side language is known, W3Techs estimates. The flaws affect every PHP installation that serves web requests, including the common set-ups with Apache and PHP-FPM, the advisory says.

Which governments took websites offline

In the Netherlands, the National Cyber Security Centre took its own site offline as a precaution, and the Port of Rotterdam, the government portal Overheid.nl, the football association KNVB, the sites of the five largest political parties and several hospitals followed, Reuters reported. France’s Interior Ministry put all its websites into preventive maintenance. In Denmark, the municipal IT company Kombit shut several services, including the national school communication platform. Finland’s state IT provider Valtori took public network services offline “as a precautionary measure”.

The operator of Wikipedia also took down some systems. In Japan, Prime Minister Sanae Takaichi told website owners to “check whether your live site uses PHP and prepare to apply the new fix.”

How AI found the PHP vulnerability

The flaws were found by Wiz, the cybersecurity company owned by Alphabet. Wiz said it used AI to find them: its own autonomous research tool, Wiz Atlas, together with Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol, according to Reuters. Without AI, the company said, the manual work would be “difficult to implement and even harder to scale”. Its co-founder called it “the most severe AI vulnerability… ever found” in an interview with The Wall Street Journal.

Both bugs sit deep in how PHP handles each web request. One comes from the way PHP recovers when it runs out of memory, which can leave half-built request data that is later treated as valid. The other lets data from one request survive after its memory is freed, so the next request on the same worker can use it.

We wrote on 2 October that Gemini 4 Argon put Google back in the AI race. Several labs now have models at that level, as we noted when Meta’s Muse Wonder reached the frontier. The same tools that found the bug can help attackers too. Costin Raiu, co-founder of the security firm TLP:Black, told Reuters that AI was powering a “race to exploit”, and that the next step could be the “mass compromise of every vulnerable web server on the internet”. Tech firms warned that some hackers were already using the flaws.

Why old websites are most at risk

The fix covers only recent versions: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. For PHP 8.1 and older, the project will not release updates, the advisory says, though minimal fixes exist for 8.1, 8.0 and 7.4 and some vendors may offer their own. That matters because much of the web runs old code. Of the sites that use PHP, 27.0% run version 7 and 7.7% run version 5, a version first released more than 20 years ago, W3Techs estimates. More than a third of PHP sites therefore run versions that get no official fix.

The advisory lists ways to reduce the risk, such as switching off one session setting and changing memory limits, but warns that only an update is a complete fix. Sites that cannot update quickly may have to stay offline.

Who could gain from the PHP vulnerability

Security stocks rose on Wednesday. In a video posted that night, the trading account The Trading Fraternity named four likely winners from the clean-up: Cloudflare, Tenable, Qualys and Check Point. Its case is about demand: every owner of a PHP site now has to find its servers, patch them or shield them, and these companies sell the tools for each step. The prices below are Wednesday’s closes, from Nasdaq.

• Cloudflare rose 5.4% to $307.33. Its network sits in front of its customers’ websites and filters the traffic, so the video argues that firms with old PHP apps they cannot update quickly will put them behind it. The shares are still 15% below their 9 October close of $360.93.
• Tenable rose 4.3% to $40.67 and Qualys 3.3% to $196.70. Both sell scanners that map a company’s systems and flag weak software; the video expects them to be used to find hidden or forgotten PHP servers. Both shares are about 2.5 times their 10 April lows, of $16.04 and $76.20.
• Check Point, the firewall maker the video called the laggard, rose 1.8% to $143.43. It is still 30% below its close of $204.97 in October 2025.

CrowdStrike, which was not on the list, rose 5.3% to $239.34.

Our view: the demand case is real, but the size is not known yet. A flaw in software that runs most of the web forces work on a vast number of servers, and the oldest, with no official fix, need shielding for months. But a day’s rise prices in some of that already, and any extra sales will show only in the next quarterly results. If patches spread fast and attacks stay rare, the spending wave will be small.

The larger cost falls on website owners. Every company, council and hospital that runs PHP has to check its servers, apply the fix or take the site down. For older systems that means a rebuild, not a patch.

What to watch

• Attacks. Reports of break-ins through the flaws would show whether the race to patch is being lost.
• Sites coming back. How fast the Dutch, French, Danish and Finnish services return.
• Vendor fixes. Whether hosting companies and Linux distributions ship fixes for PHP 7 and older.
• PHP 8.6. The next version, now in testing, already includes the fixes; its next test release is due on 5 November.