PHP developers released emergency security updates on October 21, urging users to install them immediately or temporarily take vulnerable websites offline.

The disclosure has raised concerns about the security of a significant portion of the internet, as attackers race to exploit the flaws while website operators work to identify affected systems and apply patches.

Costin Raiu, co-founder of cybersecurity research and incident response firm TLPBLACK, described the situation as an AI-powered “race to exploit,” warning that the next stage could involve the “mass compromise of every vulnerable web server on the internet.”

The scale of the exposure remains a central concern. According to internet intelligence firm Censys, about 1.5 million of 2.6 million hosts were running PHP versions for which no fix was available at the time of its assessment.

PHP powers an estimated 75% of websites whose programming language can be identified, according to technology tracker W3Techs, and underpins platforms including WordPress, Drupal, Joomla and Magento.

Tiffany Farriss, interim chief executive of the Drupal Association, said the issue affected servers running PHP versions released over the past two decades, underscoring the potential reach of the vulnerabilities.

Across Europe, precautionary shutdowns spread.

In the Netherlands, the National Cyber Security Centre took its website offline, followed by several public and private organizations, including the Port of Rotterdam, government portal Overheid.nl, the national soccer association KNVB, websites belonging to the country's five largest political parties and several hospital websites.

Finland's state IT services provider, Valtori, also suspended government public network services as a precaution, while Denmark's municipal IT company Kombit shut down several services, including the national school communication platform.

France's Interior Ministry placed all its websites under preventive maintenance. Wikipedia's operator and the Internet Archive also reported taking systems offline temporarily while addressing the security issue.

The shutdowns reflect the difficult balance facing operators: keeping essential services available while limiting exposure to vulnerabilities that may be exploited before systems can be secured.

Artificial intelligence has changed the threat assessment.

Cybersecurity firms Calif and Wiz independently reported discovering the flaws with AI assistance. Calif said it identified them on August 1, while Wiz cited its autonomous research tool, Wiz Atlas, alongside Google's Gemini 4 Argon and OpenAI's GPT-5.6 Sol.

Wiz said the vulnerabilities had remained hidden in PHP's codebase for more than a decade and would have been difficult for human researchers to exploit at scale.

Amazon security chief CJ Moses said the company's team detected an attempted attack against a decoy system on October 17, four days before public disclosure. Further attempts followed on Wednesday, although Amazon said it remained unclear whether they would have succeeded against real websites.

The timing raises questions about how attackers obtained information about the vulnerabilities before public disclosure. Moses said the source of the earlier attempt remained unknown.

While Automattic said its hosted WordPress.com services and Tumblr were protected, smaller websites using shared hosting could face greater risks because their operators often lack direct control over underlying servers.

With patches available but exposure still widespread, the immediate challenge is determining which systems remain vulnerable. AI may have helped uncover the flaws, but the speed and effectiveness of the response will determine whether the disclosure leads primarily to defensive upgrades or a broader wave of intrusions.