Government websites in Europe and elsewhere went offline on Wednesday (October 21) after the disclosure of critical vulnerabilities in a widely used programming language sent website operators around the world scrambling to protect their systems.

Developers of the PHP programming language on Wednesday released urgent new fixes to vulnerabilities that had been lurking ‌in their software for years until they were uncovered using AI, saying all users were "encouraged to update immediately."

The flaw in PHP was discovered using artificial intelligence, two cybersecurity companies - Wiz Research and Calif - said in independent reports. Calif said in a blog post it found the flaws with the help of a large language model on August 1 and had been working on a fix ever since.

"I used my expertise of what I've known from the last 20 years," said Calif researcher Ryan Austin. "I had a good hunch of where this [vulnerability] was and a hypothesis. "I was able to ask the [AI] agents and it was able verify what I had already thought of. "

Austin said the use of AI allowed the exact vulnerability to be isolated in 5 or 6 days rather than months.

Alphabet-owned cybersecurity company Wiz Research said in a blog post that it too had discovered it with the help of Wiz Atlas, its autonomous AI vulnerability research tool, as well as Google's Gemini 4 Argon and OpenAI's GPT-5.6 Sol.

"We call these pre-auth RCE, Pre-Authentication Remote Code Execution," said Tomer Schwartz, a member of the Wiz discovery team. "In cybersecurity circles, this is DEFCON level one, right? What it means is that someone on the other side of the wire can - without authentication -execute any kind of code, any kind of commands, take over the other's side."

Calif and Wiz said they coordinated with one another and the PHP team and OpenAI on the discovery.

PHP — a language that dates back to the early 1990s and initially stood for "Personal Home Page" — underpins huge parts of the public-facing web and is baked into WordPress, Drupal, Joomla and Magento sites, meaning any critical vulnerability potentially has enormous knock-on consequences.

The vulnerabilities remained hidden in the PHP codebase for more than a decade.

Schwartz said the publication of the fix had to be rushed because the news of the coding flaw had been leaked two days early.

Because a fix is now public and artificial intelligence tools are able to reverse engineer the bug with little effort, experts said they were bracing for a wave of intrusions as hackers jumped to get ahead of the updates.

"And now that the floodgates have kind of been opened with this vulnerability as well, a lot of other people are going to start looking to see what's going on," Austin said.

In a statement, the White House said it was made aware of the flaw on Friday. The National Security Agency issued an advisory about the PHP flaw on its website on Wednesday.

PHP runs roughly 75% of websites whose programming language can be identified, according to web technology tracker W3Techs, which has made experts anxious.

In the Netherlands, several organizations followed the example of the National Cyber Security Centre and took public-facing websites offline, including the Port of Rotterdam. France's Interior Ministry said it had placed all of its websites into preventive maintenance.

DESCRIPCIÓN DE IMÁGENES

INTERNET (OCTOBER 21, 2026) (NATIONAL SECURITY AGENCY - No resale)

1. SCREEN RECORDING OF NATIONAL SECURITY AGENCY WEBSITE SHOWING ADVISORY ON CRITICAL SECURITY ISSUE AFFECTING PHP

INTERNET (OCTOBER 21, 2026) (NATIONAL CYBER SECURITY CENTRE - No resale)

2. SCREEN RECORDING OF NATIONAL CYBER SECURITY CENTRE WEBSITE SHOWING NOTICE OF CRITICAL SECURITY ISSUE AFFECTING PHP

INTERNET (OCTOBER 21, 2026) (FRENCH GOVERNMENT - No resale)

3. SCREENSHOT OF FRENCH GOVERNMENT WEBSITE INFORMING OF SERVICE DISRUPTIONS

INTERNET (OCTOBER 21, 2026) (FINNISH GOVERNMENT - No resale)

4. SCREENSHOT OF FINNISH GOVERNMENT WEBSITE INFORMING OF SERVICE DISRUPTIONS

INTERNET (OCTOBER 21, 2026) (PORT OF ROTTERDAM - No resale)

5. SCREENSHOT OF PORT OF ROTTERDAM WEBSITE BEING DOWN

INTERNET (OCTOBER 21, 2026) (WIZ RESEARCH - Must on-screen credit Wiz Research. No resales)

6. SCREEN CAPTURE OF COMPUTER SCREEN SHOWING HOW PHP2SHELL VULNERABILITY EXISTS IN DRUPAL CONTENT MANAGEMENT ENVIRONMENT

WASHINGTON, D.C., UNITED STATES (OCTOBER 21, 2026) (REUTERS - Access all)

7. AERIAL OF WHITE HOUSE EXTERIOR

WEST PALM BEACH, FLORIDA, UNITED STATES (OCTOBER 21, 2026) (REUTERS - Access all)

8. (SOUNDBITE) (English) RESEARCHER AT CYBERSECURITY FIRM CALIF WHO USED AI TO UNCOVER THE CRITICAL VULNERABILITY IN PHP'S SOURCE CODE, RYAN AUSTIN, SAYING:

"So I guess think of it like your house, right, like if you like an actual house, backyard and maybe you have a garage or some other property in the back -- using this exploit [vulnerability] on someone's website is essentially getting into their front door maybe the gate to their property right and now they have access to the rest of that property and now, they're free to go around inside of the network and they can do things like ransomware and all kinds of really bad things."

9. WHITE FLASH

10. (SOUNDBITE) (English) RESEARCHER AT CYBERSECURITY FIRM CALIF WHO USED AI TO UNCOVER THE CRITICAL VULNERABILITY IN PHP'S SOURCE CODE, RYAN AUSTIN, SAYING:

"In my opinion, ransomware is about the worst thing imaginable that people do on the internet. You know, they hack these companies and encrypt the files and stuff like that. And this kind of vulnerability is exactly the kind of thing that they're [hackers] looking for."

11. WHITE FLASH

12. (SOUNDBITE) (English) RESEARCHER AT CYBERSECURITY FIRM CALIF WHO USED AI TO UNCOVER THE CRITICAL VULNERABILITY IN PHP'S SOURCE CODE, RYAN AUSTIN, SAYING:

"At least for myself and my findings with this, I, again, I used my expertise of what I've known from the last 20 years. I had a good hunch of where this was, and a hypothesis. I was able to ask the [AI] agents and it was able verify what I had already thought of. Whereas if I was just to ask it broadly to 'find remote exploit' in PHP, it's such a broad code base that would find probably a lot of false positives that sound scary and they might sound like they're exploitable, but they're actually not that dangerous."

13. WHITE FLASH

14. (SOUNDBITE) (English) RESEARCHER AT CYBERSECURITY FIRM CALIF WHO USED AI TO UNCOVER THE CRITICAL VULNERABILITY IN PHP'S SOURCE CODE, RYAN AUSTIN, SAYING:

"So it's good that, yeah, I think it's a good that we have this capability now to be able to do this rapidly. You know, rapidly - we're going to be able to do this across so many things that this, this audit without AI - this would have been months and we had this, we had something in six, six days or something. I think it was like five or six days."

15. WHITE FLASH

16. (SOUNDBITE) (English) RESEARCHER AT CYBERSECURITY FIRM CALIF WHO USED AI TO UNCOVER THE CRITICAL VULNERABILITY IN PHP'S SOURCE CODE, RYAN AUSTIN, SAYING:

"I always like to be upfront that all of these vulnerabilities that we found are patched there. Could be other vulnerabilities that are unrelated, obviously. And now that the floodgates have kind of been opened with this vulnerability as well, a lot of other people are going to start looking to see what's going on."

BERLIN, GERMANY (OCTOBER 21, 2026) (REUTERS - Access all) (MUTE)

17. STILL PHOTO OF HARD DRIVES IN COMPUTER SERVERS

18. STILL PHOTO OF CABLES CONNECTED TO COMPUTER SERVER

WEST PALM BEACH, FLORIDA, UNITED STATES (OCTOBER 21, 2026) (REUTERS - Access all)

19. (SOUNDBITE) (English) CEO AND CO-FOUNDER OF CYBERSECURITY FIRM CALIF, THAI DUONG, SAYING:

"It still requires the human intuition and human expert, you know, behind the keyboard to actually carry on these research, fighting these vulnerabilities. And I'm not even talking about, you now, fixing them, right? Fixing them requires, definitely requires a team of humans, you know. For in this case, for a sample PHP, it took them like, I think, two months, three people working like nonstop."

INTERNET (OCTOBER 21, 2026) (WIZ RESEARCH - Must on-screen credit Wiz Research. No resales)

20. SCREEN CAPTURE SHOWING HOW PHP2SHELL VULNERABILITY EXISTS IN JOOMLA CONTENT MANAGEMENT ENVIRONMENT

TEL AVIV, ISRAEL (OCTOBER 21, 2026) (REUTERS - Access all)

21. (SOUNDBITE) (English) MEMBER OF THE WIZ RESEARCH TEAM THAT INDEPENDENTLY ISOLATED THE FLAW IN PHP CODE WITH AI TOOLS, TOMER SCHWARTZ, SAYING:

"We call these pre-auth RSE, Pre-Authentication Remote Code Execution. In the cybersecurity circles, this is DEFCON level one, right? What it means is that someone on the other side of the wire can, without authentication, execute any kind of code, any kind of commands, take over the other's side. So basically, these are the kinds of vulnerabilities that we got to stop and figure out how do we want to protect against them."

INTERNET (OCTOBER 21, 2026) (WIZ RESEARCH - Must on-screen credit Wiz Research. No resales)

22. SCREEN CAPTURE SHOWING HOW PHP2SHELL VULNERABILITY EXISTS IN WORDPRESS ENVIRONMENT

TEL AVIV, ISRAEL (OCTOBER 21, 2026) (REUTERS - Access all)

23. (SOUNDBITE) (English) MEMBER OF THE WIZ RESEARCH TEAM THAT INDEPENDENTLY ISOLATED THE WEAKNESS IN PHP CODE WITH AI TOOLS, TOMER SCHWARTZ, SAYING:

"PHP is a very widespread technology. So we're talking about 70% of the websites. We've seen a ton of impact on our own customer base So one aspect is how how far it reaches. The other aspect is, how long it's been there. It's been here for 12 years undetected. What it means is that even if you've set up a website five years ago, ten years ago. It is still vulnerable even if you make sure you always update to the latest version, you install the security updates, you're still vulnerable."

24. WHITE FLASH

25. (SOUNDBITE) (English) MEMBER OF THE WIZ RESEARCH TEAM THAT INDEPENDENTLY ISOLATED THE WEAKNESS IN PHP CODE WITH AI TOOLS, TOMER SCHWARTZ, SAYING:

"The PHP team actually took our findings, along with findings from other researchers, some of them from OpenAI, some of the from a company named Calif, combined them together and took a step back because they realized that there is an architectural issue. There's a very deep problem in the way that they designed PHP 12 years ago."

26. WHITE FLASH

27. (SOUNDBITE) (English) MEMBER OF THE WIZ RESEARCH TEAM THAT INDEPENDENTLY ISOLATED THE WEAKNESS IN PHP CODE WITH AI TOOLS, TOMER SCHWARTZ, SAYING:

"It is very difficult to change this [program] because there are so many different components that depend on how PHP was designed originally. So they had to pick and choose what kind of changes they can make without making a wider impact that requires the whole ecosystem to change. Eventually they landed on a very clever change, but it requires a lot of heavy lifting. It requires some very intricate work that they've done knowing the PHP code base very well. And then we had a couple of different cycles of trying to test this as well. So we wanted to make sure that the patch does not contain any other vulnerabilities or any other ways to bypass the patch."

UNKNOWN LOCATION (ARCHIVE) (WIZ RESEARCH - Must courtesy Wiz Research. No resales) (MUTE)

28. VARIOUS OF WIZ RESEARCH OFFICES

TEL AVIV, ISRAEL (OCTOBER 21, 2026) (REUTERS - Access all)

29. (SOUNDBITE) (English) MEMBER OF THE WIZ RESEARCH TEAM THAT INDEPENDENTLY ISOLATED THE WEAKNESS IN PHP CODE WITH AI TOOLS, TOMER SCHWARTZ, SAYING:

"I think this is an unfortunate situation where information about the vulnerabilities had leaked before publication. So we had a very clear timeline in which we were planning to publish this. In reality, it leaked two days early, and we had to expedite the fix and sort of rush to an earlier release."

30. WHITE FLASH

31. (SOUNDBITE) (English) MEMBER OF THE WIZ RESEARCH TEAM THAT INDEPENDENTLY ISOLATED THE WEAKNESS IN PHP CODE WITH AI TOOLS, TOMER SCHWARTZ, SAYING:

"You have to make that very difficult decision of saying, well, 'I don't really have a packaged fix available, but on the other side, I do believe that this will get exploited in the wild, adversaries will have access to this once the patch is available, they can reverse engineer it and understand where the vulnerability is, and based on that build an exploit [cyber attack]. So I think that some of the agencies made the tough choice of saying, we can't really tolerate that risk, especially for governments."

UNKNOWN LOCATION (ARCHIVE) (WIZ RESEARCH - Must courtesy Wiz Research. No resales) (MUTE)

32. VARIOUS OF WIZ RESEARCH OFFICES

TEL AVIV, ISRAEL (OCTOBER 21, 2026) (REUTERS - Access all)

33. (SOUNDBITE) (English) MEMBER OF THE WIZ RESEARCH TEAM THAT INDEPENDENTLY ISOLATED THE WEAKNESS IN PHP CODE WITH AI TOOLS, TOMER SCHWARTZ, SAYING:

"I don't think that this particular vulnerability should cause end users to decide against PHP. I think this is actually a good story about PHP. I think they've been amazing in responding to these vulnerability disclosures. They've made some very responsible choices along a very difficult coordination schedule to push out fixes, to put end users' interests as the top priority and making sure that the world is protected."

INTERNET (ARCHIVE) (OPENAI - No resales)

34. OPENAI PROMOTIONAL VIDEO