Governments and website operators rushed to secure online services on Wednesday after researchers uncovered critical weaknesses in PHP, a technology used across much of the web, prompting precautionary shutdowns amid warnings that attackers were already targeting the flaws, Reuters reported.

Emergency updates released by PHP developers set off an urgent effort to protect vulnerable systems, with cybersecurity agencies advising operators to install the fixes or disconnect exposed websites until they could be secured, according to Reuters.

Public services across Europe taken offline

The disruption spread across public services in Europe. France’s Interior Ministry placed all its websites into preventive maintenance, while Finland’s state IT provider Valtori suspended government public network services “as a precautionary measure.”

In the Netherlands, the National Cyber Security Centre took its own website offline. Other affected organizations included the Port of Rotterdam, government portal Overheid.nl, the national football association KNVB, several hospitals, and the country’s five largest political parties.

Danish municipal IT provider Kombit also suspended several services, including the national platform used for school communications.

The shutdowns extended beyond government institutions. The Wikimedia Foundation, which operates Wikipedia, said it had temporarily disabled some systems pending security updates. The Internet Archive also briefly interrupted its services to address the vulnerabilities.

Many of the outages were preventive measures, rather than evidence that the affected organizations had suffered successful intrusions.

Attack attempts detected before public disclosure

Evidence of attempted attacks, however, emerged from Amazon, whose security chief CJ Moses said the company detected an effort to exploit the weaknesses on October 17, four days before their public disclosure.

The attempt targeted a decoy system, known as a honeypot, designed to attract and monitor suspicious activity. Moses said its origin from an anonymized internet address suggested involvement by a threat actor, although how that actor learned about the vulnerabilities remained unknown.

Amazon subsequently observed attempts by several actors before the disclosure embargo expired on Wednesday. The company said it was still assessing whether those early attempts would have succeeded against real websites, while warning that the flaws were “now being broadly exploited in the wild.”

The incident has intensified concerns that artificial intelligence is sharply reducing the time available to repair security weaknesses once they become public.

Costin Raiu, co-founder of cybersecurity research and incident response firm TLP, described an AI-driven “race to exploit,” warning of the potential for widespread intrusions into unpatched servers.

AI uncovers longstanding security weaknesses

Researchers also credited AI with helping uncover the vulnerabilities in the first place.

Cybersecurity firm Calif said it identified the weaknesses on August 1 with assistance from a large language model and subsequently worked on a fix. Alphabet-owned Wiz said it independently discovered vulnerabilities using its autonomous research tool Wiz Atlas alongside Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol.

The companies said they coordinated with each other, PHP developers, and OpenAI. The White House said it was informed of the problem on Friday.

According to Wiz, the weaknesses had remained in PHP’s code for more than a decade, with their complexity previously making exploitation exceptionally demanding.

“Pre-AI, this manual work would be difficult to implement and even harder to scale,” Wiz said. “With AI, this is no longer a barrier.”

Widespread PHP use amplifies risks

The potential exposure is extensive because PHP provides the underlying technology for platforms including WordPress, Drupal, Joomla, and Magento. It processes requests on web servers and generates content delivered to visitors’ browsers.

Web technology tracker W3Techs estimates that PHP is used by roughly 75% of websites whose server-side programming language can be identified.

Smaller organizations and independently operated websites face particular difficulties, especially when they rely on shared hosting and cannot directly update the software running their servers.

Automattic, the company behind WordPress.com, said customers using its hosted services and Tumblr were protected.

Lukasz Olejnik, a visiting senior research fellow at King’s College London, warned that the combination of widespread exposure and increasingly capable AI tools could accelerate attacks.

“The scale is huge, and with AI, exploitation may happen instantly,” he said.

Read more: Some AI dangers are already real, DeepMind's Hassabis says: Axios