Researchers using artificial intelligence discovered two critical vulnerabilities in PHP, a programming language that powers roughly 70 percent of the world's websites, triggering a global cybersecurity alert this week.

The flaws, identified by cybersecurity firms Wiz and Calif, have existed undetected for over a decade in PHP versions released since the early 2010s. Researcher Ryan Austin of Calif told the BBC it was "the most serious vulnerability I've ever found." The bugs, ranked 9.2 out of 10 in severity, could allow hackers to take control of affected web servers and steal sensitive data under the right conditions, according to Wiz.

PHP, which stands for PHP: Hypertext Preprocessor, is open-source backend code that runs on web servers. Developed in the early 1990s, it powers Wikipedia, WordPress, online shops and countless other platforms. When users visit a website, PHP processes data and renders pages they see.

The vulnerabilities, dubbed php2shell and assigned technical identifiers CVE-2026-109618 and CVE-2026-109619, affected the language itself rather than individual implementations. No successful exploits have been reported yet, but the disclosure prompted swift global action.

Governments and cybersecurity agencies rushed to issue warnings. The US National Security Agency told all organizations using PHP to take systems offline if unable to patch immediately, calling the flaw a "direct path" to exploit databases. Similar alerts came from agencies in the EU, Singapore and Australia. The PHP Foundation, a nonprofit maintaining the language, released patches on Wednesday and urged all users to update immediately.

The alert disrupted services worldwide starting October 21. Wikimedia shut down several systems as a precaution. The Finnish government, Edinburgh council, BBC pages and the Netherlands' cybersecurity agency also took websites offline. France's Orange telecommunications company suspended certain services globally during fixes. Japan's SoftBank Corp temporarily suspended emergency earthquake and tsunami alerts, prompting Prime Minister Sanae Takaichi to urge people to check if their websites ran PHP.

While many sites returned online by Thursday, disruptions continued as organizations checked for exposure. The UK Government reported 32 sites taken down as precaution, none large public-facing services. Experts warned smaller organizations with limited security resources face greater risk. As technical details become public, more exploitation attempts are likely in coming weeks, according to cybersecurity researcher Salil Kanhere of UNSW Sydney.