Global government agencies and technology firms urged website operators on Wednesday, October 21, 2026, to address two critical security flaws in PHP, a programming language that powers much of the internet. The PHP security team released urgent patches around 10 a.m. ET, warning that the vulnerabilities allowed for remote code execution. Because of the severity of the flaws, cybersecurity agencies in the U.K., U.S., Netherlands, Japan, and Australia recommended that organizations unable to apply the fix immediately should consider taking their websites offline.
PHP is an open-source language used by roughly 70% to 75% of websites, including those built on WordPress, Drupal, and Joomla. Researchers from the firms Wiz and Calif discovered the vulnerabilities using artificial intelligence (AI) tools, including OpenAI’s GPT-5.6 Sol and Google’s Gemini 4 Argon. According to Wiz, the flaws had remained undetected in the PHP codebase for more than a decade. OpenAI stated the issue was one of the most impactful security matters in recent memory because AI now makes it practical for attackers to develop exploits for such complex bugs in hours.
Numerous services were disrupted or voluntarily taken down as a precaution on Wednesday. The Finnish government shut down its public web services, and the Netherlands' National Cyber Security Centre took its own site offline, along with the Dutch parliament's lower house and the Port of Rotterdam. In the U.K., Edinburgh Council and several BBC program pages became inaccessible, though the BBC and council had not confirmed the link to PHP. The Wikimedia Foundation reported taking down several systems, causing partial outages for Wikipedia. Other sites reported offline included 4Chan, Something Awful, and Pinboard.
The scale of the threat is heightened by the role of AI in discovery and exploitation. While AI was used to find the bugs, experts such as Lukasz Olejnik of King's College London warned that the same technology allows for exploitation on a large scale. The Dutch government and Danish municipal IT firm Kombit have already suspended platforms including a national school platform and hospital websites. While a patch exists, the complexity of finding every instance of PHP means that small organizations with limited technical staff are at risk of remaining exposed.
The PHP Foundation has issued updates for the most recent versions of the language, specifically urging those on PHP 8.1 or older to upgrade. The U.S. White House stated it was briefed on the matter on Friday, October 16, 2026, and that federal agencies are working with AI labs to speed up a fix. Moving forward, the U.K. National Cyber Security Centre advised organizations to continuously monitor for updates from third-party vendors whose products may bundle PHP. There is no set deadline for when all systems will be secure, as the responsibility for patching falls on individual site administrators.