Governments and organisations worldwide are taking precautionary measures after two critical vulnerabilities in PHP, a programming language widely used to power websites, prompted cybersecurity agencies to call for immediate security updates or temporary shutdowns of vulnerable systems as reported by BBC.

The flaws, which were patched on Wednesday afternoon, have raised concerns over potential attacks on servers and the sensitive data they hold, including files and databases.

The US National Security Agency (NSA) has advised organisations using PHP to apply the necessary updates immediately, warning that systems unable to implement the fixes should be taken offline until adequate protection is in place.

“These vulnerabilities often provide a direct path to the server’s file system or database,” the NSA said in a warning posted on X, adding that more detailed guidance would follow.

The threat has already prompted several organisations to suspend online services as a precaution. Finland temporarily shut down its government’s public web services, while the Netherlands’ cybersecurity agency said it was taking its own website offline. The BBC and Edinburgh City Council were also among the organisations reported to have taken pages offline.

The incident highlights the potential disruption that vulnerabilities in widely deployed software can cause, particularly when organisations face pressure to secure their systems before attackers can exploit newly identified weaknesses.

AI changes the cybersecurity equation

The discovery of the PHP vulnerabilities has also drawn attention to the growing role of artificial intelligence in cybersecurity.

Cybersecurity firm Wiz said the flaws were identified using AI, describing them as the most severe vulnerabilities ever discovered by the technology.

The development illustrates AI’s growing ability to help researchers identify critical weaknesses in software infrastructure. However, it also reinforces concerns that increasingly capable AI tools could accelerate the discovery and exploitation of vulnerabilities by malicious actors.

Urgent action urged to protect online infrastructure

In the United States, the White House said federal agencies were working with leading AI laboratories to speed up efforts to address the issue.

For organisations running PHP-based systems, the immediate priority is to install the available security updates and verify that affected services are protected. Where patching cannot be completed promptly, cybersecurity authorities have recommended considering temporary shutdowns to reduce exposure.

The incident serves as a reminder that even widely established technologies can pose significant security risks when critical flaws emerge. It also underscores the importance of rapid patch management, continuous monitoring and coordinated responses between software developers, cybersecurity agencies and organisations operating online services.

As governments and businesses increasingly depend on digital infrastructure, the ability to respond quickly to vulnerabilities will remain essential to protecting public services, business operations and sensitive information.