Why websites around the world are suddenly going offline? What you need to know about PHP

Government agencies and businesses worldwide took websites offline on Wednesday after two critical vulnerabilities were discovered in PHP, a programming language that powers a significant portion of the internet. PHP underpins several popular web development platforms, making the security flaws a potential threat to a wide range of online services, including e-commerce stores, news websites and government portals.

Wiz, one of the cybersecurity firms that identified the vulnerabilities, estimates that PHP powers about 70 per cent of the world's websites. The company described the flaws as ranking among the most severe vulnerabilities discovered in PHP, and arguably in software history. The US National Security Agency (NSA) urged organizations to apply security patches immediately or take vulnerable systems offline to prevent potential attacks.

The vulnerabilities affect only websites running PHP on their own servers. Many large platforms that rely on other programming languages, or have operators capable of deploying patches quickly, were able to remain online. According to the NSA, the flaws often provide a direct path to the server's file system or database. Cybercriminals could potentially exploit them to gain control of web servers without requiring a password. Volker Dusch, a security engineer at the PHP Foundation, told the Wall Street Journal that it was the most serious problem PHP had faced in more than a decade. He compared the incident to Heartbleed, a major security vulnerability discovered in 2014 that triggered a global effort to secure affected systems.

The discovery comes amid a sharp increase in software security disclosures, driven in part by increasingly capable artificial intelligence models. The number of vulnerabilities identified in 2026 is on track to roughly double last year's record total. PHP developers released a security fix on Wednesday, urging administrators to update their systems without delay. "If you run PHP, it is imperative that you update now," the PHP Foundation, which funds developers working on the language, said in a blog post.

Cybersecurity firm Calif discovered the vulnerabilities in August using OpenAI's GPT-5.6 Sol model during an OpenAI-funded audit of PHP's code. Wiz, which is owned by Google, said it independently identified the flaws several weeks later with assistance from AI models, including Google's Gemini 4 Argon and GPT-5.6 Sol. OpenAI said on X that it considered the flaws one of the most impactful vulnerabilities in recent memory, adding that the discovery marks a new phase, where AI can find security bugs with internet-scale impact.

Also Read: Are the US and Israel preparing for another major attack on Iran? Here's what report claims

Govt websites and popular gaming services affected

The security incident disrupted online services in several countries as organizations moved to protect their systems. In France, several local government websites, including the Paris police website, became inaccessible at the request of the French National Cybersecurity Agency, according to the interior ministry.

In the Netherlands, the national digital identity service DigiD, the House of Representatives website and the national cybersecurity center's website were taken offline as a precaution, Dutch public broadcaster NOS reported. In Australia, the Australian Signals Directorate confirmed that its own cyber.gov.au website was among the government sites affected by the vulnerabilities, according to public broadcaster ABC.

The Wikimedia Foundation, which operates Wikipedia, warned users that its websites could experience outages while the organization addressed the security issues. It also said it had deliberately taken many supporting services offline until they could be patched safely. The impact extended to gaming services. Several Pokémon applications, including Pokémon HOME, Pokémon Champions and Pokémon Sleep, went offline on Wednesday for emergency maintenance. Pokémon Sleep cited security measures, according to gaming news outlet Kotaku. The operator of the popular Japanese game Umamusume also announced maintenance to address a PHP vulnerability discovered on its servers.