Severe PHP security flaws force government websites offline worldwide amid attack fears

Two serious security flaws have been found in PHP, the programming language behind a huge share of the world's websites. Experts warn that attackers could exploit the flaws to enter servers without any password. As a precaution, government agencies and commercial organisations around the world have temporarily taken their websites offline.

According to the cybersecurity firm Wiz, roughly 70 percent of the world's websites use PHP. The firm says this is among the most serious security flaws ever identified in PHP — and possibly one of the biggest weaknesses in software history.

PHP is used by many popular web design platforms, so the flaws could put online marketplaces, news outlets, government services and many other kinds of websites at risk.

The US National Security Agency (NSA) has advised organisations to install the security update quickly. Where an immediate update is not possible, it advised keeping at-risk systems disconnected from the internet.

In a statement on X, the NSA said attackers could use the flaws to gain direct access to a server's files or database — and could even take full control of a server without any password.

Volker Dusch, a security engineer at the PHP Foundation, told the Wall Street Journal that PHP faces its most serious security problem in more than a decade. He compared it to the much-discussed ‘Heartbleed’ flaw of 2014, which also triggered a worldwide rush to update software.

The story of how the flaws were found is striking. The cybersecurity firm Calif discovered them in August using OpenAI's GPT-5.6 Sol model, during a review of PHP's code funded by OpenAI. A few weeks later, Wiz independently identified the same flaws, using Google's Gemini 4 Argon and the GPT-5.6 Sol model.

OpenAI wrote on X that it considers this one of the biggest security flaws of recent times. The company said it marks a new step in technology: artificial intelligence can now itself find major flaws capable of affecting the entire internet.

PHP's developers released a fix on Wednesday. The PHP Foundation, which funds the developers, said in a blog post that anyone using PHP needs to update immediately, and users have been urged to install the update without delay.

Several governments have already shut websites as a precaution. France's interior ministry said local administration websites were closed from Wednesday afternoon at the request of the national cybersecurity agency, including the Paris police website.

The Dutch national broadcaster NOS reported that the Netherlands' digital identity service DigiD, the website of the House of Representatives and the national cybersecurity centre's website were taken offline as a precaution. Belgium's foreign ministry also temporarily closed its website, though the Belgian cybersecurity centre said no attack on a Belgian website had been recorded by then.

Australia's national broadcaster ABC reported that among the websites affected by the PHP flaws is the Australian Signals Directorate's own cybersecurity website, cyber.gov.au.

Experts say the update will take time to spread, and until it does, sites that have not updated will remain at risk — leaving website operators around the world facing a busy and watchful few days ahead.