Websites around the world have been taken down as a precaution after weaknesses were found in PHP, a programming language used by millions of websites.

The response has been dramatic, public and global, even though no major attack has been reported. There has been no damaging incident like the ransomware attacks that hit M&S and JLR in 2025.

Less than two months ago, 100 technology companies signed an open letter urging the world to build a new level of cyber resilience in the age of AI. The PHP flaws show how quickly that warning could become relevant.

How the flaws were found

The weaknesses had existed in PHP for years and are not easy to exploit. One cyber security researcher said he had spent a night trying to exploit them as an experiment, but found it very difficult.

AI tools are making such tasks far easier. The technology is being credited with helping researchers find the bugs. The PHP Foundation, which oversees the language, developed and issued a fix.

The fix was meant to stay confidential until website owners had time to update their sites. The news was leaked, and the timeline for attackers began.

The risk for defenders and attackers

As of writing, there are no reports that anyone has successfully used the flaws to attack a website.

“There’s a real dilemma,” said Prof Alan Woodward of the University of Surrey. “How do you alert people that they need to be ready, and that a patch is urgently required, without alerting attackers?

“Basically, you’re telling everyone about the problem at the same time and hoping the defenders aren’t awake enough to act as soon as the patch is out.”

Large web companies, including Cloudflare and Palo Alto Networks, say millions of attempts to exploit the flaws have been made. It may take some time to know whether any attack has succeeded, as affected companies may not yet be aware of any breach.

Gina Neff, Professor of Responsible AI at Queen Mary University, described the situation as a good news story. “We’ve seen how a team of people, supported by the large AI company, used AI to find the problem, worked for months to solve it, and got everybody ready to be safe and secure,” she told the Today Programme on BBC Radio 4. “We have enormous capability to handle these risks.”

Security experts warn that attackers may also use AI, and such tools could already be searching for ways in.

What website owners need to do

Cyber security authorities are urging website owners to fix the weaknesses immediately. The patch only works on the latest version of PHP, so older sites will need to upgrade first.

For many, the work could be significant. Web developers may need extensive time to complete the repairs.