Government websites in Europe and elsewhere went offline on Wednesday after the disclosure of critical vulnerabilities in a widely used programming language sent website operators around the world scrambling to protect their systems.

Developers of the PHP programming language on Wednesday released urgent new fixes to vulnerabilities that had been lurking in their software for years until they were uncovered using AI, saying all users were “encouraged to update immediately.”

With tech firms warning that some hackers were already exploiting the flaws, government agencies across Europe were among those that took sites offline as a precaution.

Because a fix is now public and artificial intelligence tools are able to reverse engineer the bug with little effort, experts said they were bracing for a wave of intrusions as hackers jumped to get ahead of the updates.

AI was powering a “race to exploit,” said Costin Raiu, co-founder of cybersecurity research and incident response firm TLP:Black. He said the next step was the “mass compromise of every vulnerable web server on the internet.”

PHP — a language that dates back to the early 1990s and initially stood for “Personal Home Page” — underpins huge parts of the public-facing web and is baked into WordPress, Drupal, Joomla and Magento sites, meaning any critical vulnerability potentially has enormous knock-on consequences.

“All servers using any version of PHP released in the last 20 years will be vulnerable,” said Tiffany Farriss, the interim chief executive of the Drupal Association. “This issue impacts the majority of the internet.”

Cybersecurity agencies around the world have urged PHP users to update immediately or take websites offline until patches can be applied.

According to data from Censys, the internet intelligence firm, about 1.5 million out of 2.6 million hosts report running a version of PHP for which there is no fix.

The Dutch cybersecurity agency itself went offline, saying it had done so as a precaution because of the vulnerabilities. The operator of the online encyclopedia Wikipedia also said it had taken down an unspecified number of systems until they could be safely patched, while the Internet Archive, the sprawling online library, said it also briefly went offline to deal with the issue.

Even some world leaders weighed in. The Dutch prime minister said he was closely monitoring the situation. Japanese Prime Minister Sanae Takaichi in a post on X said website owners should “check whether your live site uses PHP and prepare to apply the new fix.”

BUG FOUND WITH AI

The flaw in PHP was discovered using artificial intelligence, two cybersecurity companies said in independent reports. Calif said in a blog post it found the flaws with the help of a large language model on August 1 and had been working on a fix ever since. Alphabet-owned GOOGL.O cybersecurity company Wiz said in a blog post that it too had discovered it with the help of Wiz Atlas, its autonomous AI vulnerability research tool, as well as Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol.

The vulnerabilities remained hidden in the PHP codebase for more than a decade and would have been extraordinarily complicated for a human hacker to take advantage of, Wiz’s post said.

“Pre-AI, this manual work would be difficult to implement and even harder to scale,” it said. “With AI, this is no longer a barrier.” Calif and Wiz said they coordinated with one another and the PHP team and OpenAI on the discovery.

In a statement, the White House said it was made aware of the flaw on Friday.

In a blog post late on Wednesday, Amazon AMZN.O security chief CJ Moses said the tech giant’s security team detected an attempt to exploit the vulnerabilities against one of its decoy “honeypot” systems on October 17, four days before public disclosure.

The attempt on the system came from an anonymous internet address, suggesting the activity was conducted by a threat actor, Moses said, adding it was unclear how the actor learned of the flaws while they were under embargo.

More attempts followed on Wednesday by multiple actors before the embargo lifted. Amazon said it was still unclear whether any of the attempts would have worked against real websites, adding the flaws were “now being broadly exploited in the wild.”

CRITICAL SOFTWARE

PHP is a programming language used to run websites. When a visitor loads a page, a server running PHP assembles the content and sends it to the browser. It is free, open-source software maintained by volunteers.

Its ubiquity — PHP runs roughly 75% of websites whose programming language can be identified, according to web technology tracker W3Techs — has made experts anxious. AI-assisted hacking campaigns, which have proliferated in recent weeks, could wreak havoc on unpatched servers, said Lukasz Olejnik, a visiting senior research fellow at King’s College London.

“The scale is huge, and with AI, exploitation may happen instantly,” Olejnik said.

WordPress.com operator Automattic said users of its hosted solutions and Tumblr were safe from the bug. Risks were higher for small PHP-powered websites run by individuals or organizations with limited technical resources, often on shared hosting services where customers do not directly manage the underlying servers.

MASS OUTAGES

In the Netherlands, several organizations followed the example of the National Cyber Security Centre and took public-facing websites offline, including the Port of Rotterdam, government portal Overheid.nl, the national soccer association KNVB, the websites for the country’s five largest political parties and several hospital websites.

Danish municipal IT company Kombit said it had shut down several services, including the national school communication platform.

Disruption was even more widespread in Finland, where state IT services provider Valtori said government public network services had been taken offline “as a precautionary measure.”

France’s Interior Ministry said it had placed all of its websites into preventive maintenance.

The European Commission on Wednesday announced that it has opened formal proceedings against Booking.com to investigate whether the accommodation platform breached EU digital rules by failing to tackle fraudulent property listings and phishing scams, and by not clearly identifying paid-for search results as advertisements.

The investigation will assess whether the company complied with the Digital Services Act (DSA), which requires major online platforms to identify and mitigate systemic risks and ensure advertising transparency.

The Commission will examine whether Booking.com adequately identified and assessed risks associated with illegal content, including fake listings for non-existent properties, impersonation fraud and accommodation offers that do not comply with applicable requirements.

It will also assess whether the platform introduced effective measures to reduce these risks, including removing fraudulent and non-compliant listings, which can undermine consumer protection.

A second area of investigation concerns phishing scams exploiting reservation and guest data.

The Commission will examine whether Booking.com properly assessed and addressed the risks posed by such scams, particularly in relation to how reservation and guest information is shared with accommodation providers and how the platform’s messaging service is designed and operates.

It will also investigate whether sufficient safeguards are in place to prevent data from being misused to carry out phishing attacks or solicit fraudulent payments from customers.

The third area concerns paid-for listings that receive greater visibility in search results.

Accommodation providers can improve their ranking on Booking.com by paying higher commissions, but the Commission said users should be able to recognise clearly when such boosted listings are advertisements.

The investigation will assess whether the platform complies with advertising transparency requirements, including whether users can readily identify who is behind each advertisement, who paid for it, why it is being shown to them and how they can change the settings determining which advertisements they see.

Under the DSA, users must be able to understand when an advertisement is shown and on whose behalf it appears, allowing them to distinguish between listings that rank prominently because they match a search and those promoted through paid visibility.

If the suspected failures are established, they could constitute breaches of Articles 34 and 35 of the DSA, which require very large online platforms and search engines to identify, analyse, assess and mitigate systemic risks, as well as Article 26(1), which requires online platforms to ensure advertisements and related information are clearly identifiable.

The Commission said it would conduct an in-depth investigation as a matter of priority, gathering further evidence through additional requests for information, interviews or inspections.

The proceedings also empower the Commission to take further enforcement measures, including interim measures and decisions establishing non-compliance, or to accept commitments offered by Booking.com to address the concerns.

However, opening proceedings does not prejudge the outcome of the investigation or affect enforcement action by other authorities under separate regulatory frameworks.

The decision also removes the powers of member states’ Digital Services Coordinators and other competent authorities to supervise and enforce the DSA in relation to the suspected Article 26(1) infringement covered by the proceedings.

The Commission’s decision follows a preliminary investigation that examined Booking.com’s risk assessment reports submitted in 2026 and the preceding three years, its transparency reports, and its responses to formal information requests sent on September 23, 2025, and May 26, 2026.

The Commission is cooperating with the Dutch Authority for Consumers and Markets, the Digital Services Coordinator in the member state where Booking.com is established, in overseeing the company’s compliance with the DSA.

Booking.com was designated a Very Large Online Platform under the EU legislation on April 25, 2023.

Cyprus-based technology distributor Asbis surpassed $1 billion in monthly sales for the first time in its history in September, generating estimated consolidated revenues of $1.05 billion, a 216 per cent increase compared with the same month last year, the company announced on Wednesday.

The Limassol-headquartered group’s revenues rose from $332 million in September 2025, making the latest month both its strongest September on record and its highest-revenue month ever.

“September 2026 will go down in ASBIS history as the month in which we achieved the highest sales in the Group’s history,” said Serhei Kostevitch, chief executive officer of Asbis Group.

“Revenues of $1.05bn and 216 per cent year-on-year growth confirm the enormous potential of our company, the scale of our operations and the opportunities offered by our presence across multiple markets,” he added.

Kostevitch said the record performance had been achieved through the group’s regular business activities, reflecting the strength of its business model, broad product portfolio and relationships with global manufacturers and trading partners.

“Most importantly, this result is the outcome of our regular operating activities and demonstrates the strength of our business model, broad product portfolio and relationships with global manufacturers and trading partners,” he said.

The company attributed its performance partly to growing demand for artificial intelligence solutions, computing infrastructure and other advanced technologies across its international markets.

“Growing demand for AI solutions, computing infrastructure and modern technologies is creating new opportunities for the entire industry,” Kostevitch said.

“We have good visibility and our pipeline of projects suggest a continuation of AI development,” he added.

Kazakhstan, the United Arab Emirates and Ukraine generated the largest shares of Asbis’ September revenues, followed by Slovakia and Poland, which continues to account for a significant portion of the group’s sales.

The company also reported particularly strong growth in servers and server components, while smartphones delivered another solid performance.

“In product terms, we recorded the largest sales growth in September in the servers and server components segment,” Kostevitch mentioned.

“The smartphone segment also performed very well, which means we are growing beyond the AI segment as well,” he stated.

The latest figures extend a period of exceptional growth for Asbis, which recorded its most profitable quarter in its 36-year history during the second quarter of 2026, as demand for artificial intelligence infrastructure, servers and smartphones strengthened across its markets.

Record quarterly and half-year results

Asbis generated revenues of $1.69bn in the second quarter, an increase of 78.7 per cent from $949.3m in the corresponding period of 2025.

Net profit for the quarter more than tripled to $44.3m from $12.1m a year earlier.

For the first half of 2026, consolidated revenues reached $2.97bn, up 76 per cent year on year, while net profit after tax climbed to $80.6m from $19.4m in the first six months of 2025.

The strong results followed further monthly revenue increases over the summer.

In August, Asbis reported estimated revenues of $604m, up 91 per cent from $316m in August 2025.

July revenues had risen by 89 per cent year on year to $531m, compared with $281m in the corresponding month of 2025.

September’s estimated revenues therefore represented a substantial acceleration in growth, taking monthly sales above the $1bn threshold for the first time.

The developers of the widely used PHP programming language said on Wednesday they would release patches for two critical vulnerabilities, as EU cybersecurity officials warned organisations unable to apply the fixes should take affected websites offline.

PHP is used across large parts of the internet, and speculation has circulated over the past day that websites running the software could be exposed to serious cyber intrusions.

“PHP is everywhere. It quietly powers WordPress, Drupal, Joomla, and Magento sites, shared hosting platforms, control panels, and an awful lot of software that doesn’t even advertise that it runs PHP under the hood,” cybersecurity company Huntress said in a blog post.

In a security update, PHP said both vulnerabilities were rated 9.2 on the CVSS v4.0 severity scale and urged users to “upgrade as soon as the release is available”.

It said a patch for both vulnerabilities was scheduled for 1400 GMT on Wednesday.

Dane Knecht, the chief technology officer of Web and cloud security firm Cloudflare NET.N, said that attacks were emerging and Cloudflare was updating its firewall rules as a stopgap measure.

“We are seeing early attacks emerging and are updating mitigations as new vectors show up. This is a STOPGAP only. Patch as soon as PHP releases the update,” he said on X.

The European Union Computer Emergency Response Team (CERT-EU) said on Tuesday in an advisory that the 9.2 rating indicated a risk of unauthenticated remote code execution, a type of flaw that can allow attackers to run malicious code on vulnerable systems without logging in.

CERT-EU urged organisations to prepare for the immediate patching of affected assets and said those unable to do so should consider taking affected sites offline.

The Australian Cyber Security Centre (ACSC) issued similar guidance, urging organisations to identify PHP systems in their environments, prepare to apply patches and monitor applications for signs of malicious activity.

“ACSC is currently not aware of active exploitation related to these vulnerabilities,” the agency said.

Web hosting provider GoDaddy said the flaws could allow attackers to execute code on affected servers over the internet, potentially leading to data theft, website defacement or full system compromise.

Wordfence, a security plugin that protects WordPress websites, said all WordPress sites run on a PHP-installed server. It warned that automatic updates would not apply the fix and advised site owners to find out who is responsible for updating PHP on their sites.

PHP’s security team said details of the vulnerabilities, affected versions and the fixed releases would be published when patches are issued.

CERT-EU and the ACSC said all PHP versions from PHP 5 onward could be affected, although PHP has not disclosed which versions are vulnerable.