Government websites across Europe and beyond were taken offline on Wednesday after cybersecurity agencies issued urgent warnings over two critical vulnerabilities in the PHP programming language, with experts warning of a global “race to exploit”.
The flaws, collectively dubbed PHP2Shell, could allow attackers to seize control of web servers remotely and read memory holding sensitive information such as passwords — without needing a login. They are believed to have gone undetected for years.
The bugs were found in August during an OpenAI-funded audit of PHP’s code by security firms Wiz and Calif, using AI models including OpenAI’s GPT-5.6 Sol and Google’s Gemini 4 Argon. Wiz said a single researcher completed in a week what would previously have taken a world-class team months.
The findings were disclosed publicly on Wednesday, hours after PHP developers released emergency fixes. The PHP Foundation urged all operators to update immediately: “If you run PHP, it is imperative that you update now.”
The exposure is vast. PHP powers WordPress, Drupal, Joomla and Magento, and tracker W3Techs estimates it runs roughly 75 per cent of websites whose programming language can be identified. Drupal’s Tiffany Farriss said it “impacts the majority of the Internet”, with servers running PHP versions released over the past 20 years vulnerable.
The US National Security Agency issued a rare public warning, telling organisations to patch immediately or pull vulnerable systems offline. Agencies in Europe, Australia, Japan and Britain issued urgent advisories, the Dutch National Cyber Security Centre itself briefly went offline, and Wikipedia took an unspecified number of systems down for patching.
With hackers reportedly already probing the flaws, experts fear attackers will use AI to exploit vulnerable systems at massive scale. Costin Raiu of cybersecurity firm TLP said AI was powering a “race to exploit”.
The PHP Foundation’s Volker Dusch called it the most serious PHP problem in over a decade, comparing it to Heartbleed, the 2014 flaw that triggered a worldwide patching rush. Vulnerability discoveries in 2026 are on track to roughly double last year’s record total.
