Two critical vulnerabilities in PHP, a programming language underpinning an estimated 70% of websites worldwide, have triggered emergency security measures and widespread website shutdowns.
The flaws, known as PHP2Shell, remained undetected for more than a decade before researchers using artificial intelligence identified them.
Governments, technology companies and cybersecurity agencies are now racing to secure affected systems amid reports of rapidly increasing exploitation attempts.
PHP is an open-source programming language used by major platforms including WordPress, Wikipedia and Drupal.
The vulnerabilities affect memory management and error handling, components involved in nearly every PHP request.
According to the PHP Foundation, the flaws could allow attackers to compromise web servers, access databases and steal sensitive information.
Researchers from cybersecurity firms including Wiz and Calif helped identify the vulnerabilities using advanced AI tools.
The discovery was initially scheduled for disclosure on October 22, but information circulating online prompted an earlier announcement.
The PHP Foundation released emergency patches on Wednesday and urged immediate installation.
Amazon reported detecting exploitation attempts four days before public disclosure.
Cloudflare subsequently recorded millions of attempted exploits across its network, highlighting the growing scale of the threat.
Website disruptions have affected government services and public organisations across multiple countries.
Wikimedia temporarily disabled several systems, while authorities in Finland, Scotland and the Netherlands took websites offline as precautions.
The United States National Security Agency urged organisations unable to apply patches immediately to suspend affected services.
British cybersecurity authorities issued similar guidance, alongside agencies in the European Union, Singapore and Australia.
Japanese Prime Minister Sanae Takaichi also called for urgent action to secure publicly accessible websites.
Security specialists warned that smaller organisations and poorly maintained platforms could face heightened exposure.
Website operators must update PHP itself, rather than relying solely on WordPress or plugin updates.
The incident also underscores the expanding role of AI in cybersecurity, accelerating both vulnerability detection and potential exploitation.