Critical vulnerabilities in the PHP programming language prompted government websites across Europe to temporarily go offline Wednesday as organizations scrambled to apply emergency security patches. This prompted the Federal Bureau of Investigation’s Cyber Division to call for immediate security updates as cybersecurity experts warned that AI could accelerate attacks against millions of vulnerable servers.
FBI Urges Immediate Updates And Server Monitoring
The FBI identified two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that could allow hackers to remotely execute malicious code and compromise sensitive information. Developers released emergency fixes Wednesday, urging users to "update immediately."
In an X post, the FBI Cyber Division advised organizations to identify affected PHP installations, prioritize internet-facing systems and take vulnerable websites offline if immediate patching proved impossible.
The agency also recommended monitoring suspicious activity, isolating compromised systems, preserving server logs and reporting incidents through its Internet Crime Complaint Center.
The warning follows broader concerns about AI-enabled cyberattacks, including OpenAI CEO Sam Altman’s warning about potentially severe cybersecurity incidents.
European Websites Go Dark As Leaders Respond
Reuters reported that government websites in the Netherlands, Finland and France went offline as a precaution, alongside services operated by Wikipedia and the Internet Archive.
Japanese Prime Minister Sanae Takaichi urged website operators on X to "check if your publicly available websites use PHP" and apply security patches immediately, recommending temporary shutdowns where necessary.
European cybersecurity authorities likewise urged organizations to prioritize vulnerable public-facing systems.
AI Discovery Raises Fears Of Widespread Exploitation
Cybersecurity firms Calif and Alphabet-owned Wiz independently discovered the flaws using AI tools. According to Reuters, PHP powers nearly 70% of websites whose server-side programming language can be identified
Costin Raiu, co-founder of TLP, warned that AI was fueling a "race to exploit," potentially leading to the "mass compromise of every vulnerable web server on the internet."
Amazon security chief CJ Moses reported exploitation attempts against company honeypots before Wednesday’s disclosure, while Cloudflare subsequently detected millions of attempted attacks.
The developments reinforce warnings about AI-driven cybersecurity threats.
Photo courtesy: Shutterstock