# PHP security flaw found by AI takes government websites offline in Europe; update your site now

Source: Searchable (https://searchable.pk/news/technology/php-security-flaw-found-by-ai-takes-government-websites-offline-in-europe-update)
Type: News article
Author: Searchable Editorial
Published: 21 Oct 2026
Updated: 21 Oct 2026
Retrieved: 25 Oct 2026

> Wiz used AI to find critical bugs hidden in PHP for years, and governments from the Netherlands to France pulled sites offline. If your business or school website runs on PHP, this is your patch day.

PHP, the programming language behind a large share of the world's websites, released **urgent security fixes on Wednesday 21 October 2026** after the cybersecurity company **Wiz** found critical flaws in it using artificial intelligence. Governments and companies in Europe took websites offline while they patched, Reuters reported in a story carried by [Dawn](https://www.dawn.com/news/2038808/government-websites-go-dark-after-ai-discovered-flaw-sparks-security-scramble) and [Business Recorder](https://www.brecorder.com/news/40445290/websites-go-dark-worldwide-as-ai-exposes-critical-security-flaws).

For readers in Pakistan the practical point is simple: if you own or run a website, check whether it uses PHP (most WordPress sites do) and ask your developer or hosting company to apply the fix today.

## What was found

According to the Reuters report, the flaws had been hidden in PHP's code for years, possibly more than a decade. Wiz, which is owned by Google's parent Alphabet, said in a blog post that it found them with its own autonomous AI research tool, **Wiz Atlas**, alongside Google's **Gemini 4 Argon** and OpenAI's **GPT-5.6 Sol**. Wiz said it worked with the PHP team, OpenAI and the security firm Calif on the discovery and on checking the patch. The report did not publish technical details or a CVE number.

The White House said it became aware of the flaw on Friday.

## Who went offline

- **Netherlands:** the National Cyber Security Centre, the Port of Rotterdam, the government portal Overheid.nl, the football association KNVB, the websites of the five largest political parties and several hospitals.
- **Denmark:** the municipal IT company Kombit shut several services, including the national school communication platform.
- **Finland:** the state IT provider Valtori took public network services offline as a precaution.
- **France:** the Interior Ministry put all its websites into preventive maintenance.
- **Elsewhere:** Wikipedia's operator took down some systems, and Japan's Sakura Internet suspended a database feature. Japan's Prime Minister Sanae Takaichi told website owners to check whether their sites use PHP and prepare to apply the fix.

Security agencies in Europe, Australia, Japan and Britain told users to update immediately or take sites offline until they could. No Pakistani government site was named in the report.

## What it means for you in Pakistan

Thousands of Pakistani small businesses, schools, clinics and shops run their websites on shared hosting, often on WordPress. Experts quoted by Reuters warned that shared-hosting sites, run by small organisations with limited resources, are likely to take longer to patch and stay exposed longest.

What to do today:

1. **Ask your host or developer** whether your site runs PHP and which version, and when the patched release will be installed.
2. **Update** PHP through your hosting control panel if you manage it yourself, then update WordPress, its plugins and themes.
3. **If you cannot patch quickly**, consider putting the site into maintenance mode, as several European bodies did, rather than leaving it exposed.
4. **Watch for odd behaviour:** new admin accounts, changed pages or unexpected redirects are signs of a break-in.

If your business is in our [directory](/businesses/restaurants/lahore) with a website link, a hacked site can also send your customers to scam pages, so it is worth a call to your developer tonight.

We will add the official PHP advisory and CVE numbers here once they are public.

## Frequently asked questions

**Is my WordPress site affected by the PHP flaw?**

WordPress runs on PHP, so ask your host which PHP version your site uses and when the 21 October 2026 fix will be installed, then update WordPress and its plugins.

## Sources

- Government websites go dark after AI-discovered flaw sparks security scramble (Reuters, 21 Oct 2026) (Dawn): https://www.dawn.com/news/2038808/government-websites-go-dark-after-ai-discovered-flaw-sparks-security-scramble
- Websites go dark worldwide as AI exposes critical security flaws (21 Oct 2026) (Business Recorder): https://www.brecorder.com/news/40445290/websites-go-dark-worldwide-as-ai-exposes-critical-security-flaws

How to cite: "PHP security flaw found by AI takes government websites offline in Europe; update your site now", Searchable, 21 Oct 2026, https://searchable.pk/news/technology/php-security-flaw-found-by-ai-takes-government-websites-offline-in-europe-update