The US government is working to address and stop potential cybersecurity problems stemming from flaws in PHP, a widely used open source software, that could impact federal agencies and critical infrastructure in the US, according to a White House official.
The programming language called PHP has two vulnerabilities that could potentially expose companies that use it on websites and software platforms to cyberattacks. The developers responsible for maintaining PHP said On Wednesday, they released software updates to patch the vulnerabilities and urged users to apply these changes immediately. The US government is coordinating with technology companies to roll out the security updates, according to a White House official.
PHP is one of the most widely used technologies on the web, powering millions of websites. Any vulnerability could therefore propagate through the Internet’s software supply chain, potentially exposing online services to data theft, malware and security breaches. Taking websites offline means attackers cannot reach and exploit the vulnerability while it is remedied.
Alphabet Inc.-owned cybersecurity firm Wiz said in a report published Wednesday that it discovered the vulnerabilities using several artificial intelligence tools. It said it worked with OpenAI and cybersecurity firm Calif on the work. Wiz’s report estimates that the PHP vulnerability affected about 70% of the internet and had remained undetected for more than a decade, but AI tools helped quickly find a fix for it.
“With groundbreaking AI models and the right tools, a single researcher did in a week what would have taken months of work for a world-class team,” it said.
The US Office of the National Cyber Director worked with the Federal Bureau of Investigation, the Cybersecurity and Infrastructure Security Agency, the National Security Agency and others to address the issue.
Governments in Europe took websites offline on Wednesday in response to warnings of critical security vulnerabilities. The Finnish government announced that it is taking all publicly available internet services offline as a precautionary measure. Websites of Dutch national and local authorities were also deleted.
This was stated by the British National Cyber Security Center a warning Wednesday that companies should work to identify all systems running PHP, scan them for malicious activity and consider taking them offline until the vulnerabilities can be fixed.
The websites of the Dutch House of Representatives and the National Center for Cybersecurity were unavailable as of 5:40 p.m. local time. Dutch news agency ANP reported that more than 100 municipalities, provinces and water authorities were affected because they use a service from a software company Notubiz. According to its website, Notubiz counts 254 Dutch municipalities among its customers. Notubiz did not immediately respond to a request for comment.
Some universities in Germany and Austria have also withdrawn their locations, including the University of Vienna and the University of Freiburg.
According to cybersecurity firm Huntress, PHP is “everywhere,” quietly powering websites running WordPress, Drupal, Joomla and Magento. PHP is also present “under the hood” of software, even though the software may not advertise that it uses it, Huntress said.
If there is a critical vulnerability in PHP, Huntress advised A report on Wednesday said: “The number of places to look for vulnerable PHP versions is becoming very large, very quickly.”
Dane Knecht, chief technology officer of cybersecurity company Cloudflare Inc., said in a Post on X that his company had observed some “early attacks” attempting to exploit the vulnerabilities. In response, Cloudflare introduced protections for customers whose websites were shielded using its technology.
Photo: Photo credit: Chris Ratcliffe/Bloomberg
Copyright 2026 Bloomberg.
Topics
USA
The most important insurance news in your inbox every business day.
Get the insurance industry’s trusted newsletter
