AI-discovered PHP vulnerability triggers security emergency response; government websites in Europe and elsewhere taken offline

PHP developers released an emergency fix on Wednesday for a long-latent critical vulnerability discovered with the help of AI; government websites in Europe and elsewhere were taken offline as a precaution, and website operators worldwide scrambled to respond. Tech companies warned that hackers are already exploiting these vulnerabilities, and because the fix is public and AI tools can easily reverse-engineer the vulnerability, experts are preparing for a wave of intrusions; Costin Raiu, co-founder of TLP:Black, said AI is driving an "exploitation race." PHP underpins a large number of websites including WordPress, Drupal, Joomla and Magento; Tiffany Farriss, interim CEO of the Drupal Association, said servers using any PHP version released in the past 20 years will be affected. Cybersecurity agencies in Europe, Australia, Japan and the UK urged users to update immediately or temporarily take websites offline; the Dutch cybersecurity agency took its own systems offline as a precaution, Wikipedia also took some systems offline pending patching, and Japanese Prime Minister Sanae Takaichi reminded website owners on X to check whether their live websites use PHP and to prepare to apply the new fix.