Government websites in Europe and elsewhere went offline on Wednesday after the disclosure of critical vulnerabilities in a widely used programming language sent website operators around the world scrambling to protect their systems.

Developers of the PHP programming language on Wednesday released urgent new fixes to vulnerabilities that had quietly been lurking in their software for years until they were uncovered using AI, saying that all users were “encouraged to update immediately.”

With tech firms warning that some hackers were already exploiting the flaws, government agencies across Europe were among those that took sites offline as a precaution.

Because a fix is now public and artificial intelligence tools are able to reverse engineer the bug with little effort, experts said they were bracing for a wave of intrusions as hackers jumped to get ahead of fixes.

AI was powering a “race to exploit,” said Costin Raiu, co-founder of cybersecurity research and incident response firm TLP: Black. He said the next step was the “mass compromise of every vulnerable web server on the internet”.

PHP, a language that dates back to the early 1990s and initially stood for “Personal Home Page”, underpins huge parts of the public-facing web and is baked into WordPress, Drupal, Joomla and Magento sites, meaning that any critical vulnerability potentially has enormous knock-on consequences.

“All servers using any version of PHP released in the last 20 years will be vulnerable,” said Tiffany Farriss, the interim chief executive of the Drupal Association. “This issue impacts the majority of the Internet.”

Cybersecurity agencies in Europe, Australia, Japan and Britain have urged PHP users to update immediately or take websites offline until patches can be applied.

The Dutch cybersecurity agency itself went offline, saying it had done so as a precaution because of the vulnerabilities. The operator of the online encyclopedia Wikipedia also said it had taken down an unspecified number of systems until they could be safely patched.

Even some world leaders, who don’t typically get involved with software updates, weighed in. Japanese Prime Minister Sanae Takaichi, in a post on X, said website owners should “check whether your live site uses PHP and prepare to apply the new fix.”

Bug found with AI

The flaw in PHP was discovered using artificial intelligence, Alphabet-owned cybersecurity company Wiz said in a blog post.

The vulnerabilities remained hidden in the PHP codebase for more than a decade and would have been extraordinarily complicated for a human hacker to have taken advantage of, the post said.

“Pre-AI, this manual work would be difficult to implement and even harder to scale,” it said. “With AI, this is no longer a barrier.”

Wiz said its research relied on Wiz Atlas, its autonomous AI vulnerability research tool, as well as Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol. Wiz said it coordinated with the PHP team, OpenAI, and the cybersecurity company Calif on the discovery of the vulnerability and patch verification.

The company said it also partnered with Google Cloud, Cloudflare, Amazon’s AWS, Microsoft, WordPress.com operator Automattic, and other companies such as Fastly, Akamai, Imperva, and Vercel to protect customers and prepare mitigations.

In a statement, the White House said it was made aware of the flaw on Friday.

“This discovery demonstrates exactly why American leadership in SI is so critical,” the White House said, referring to President Donald Trump’s preferred term for artificial intelligence. “This is American innovation strengthening our national security.

Critical software

When a visitor loads a page, a server running PHP assembles the content and sends it to the browser. It is free, open-source software maintained by volunteers.

Because of its ubiquity, PHP runs roughly 75 per cent of websites whose programming language can be identified, according to web technology tracker W3Techs, and because the vulnerabilities are considered so dangerous, experts are anxious about a potentially vast pool of sitting ducks.

AI-assisted hacking campaigns, which have proliferated in recent weeks, would only make things worse, said Lukasz Olejnik, a visiting senior research fellow at King’s College London.

“The scale is huge, and with AI, exploitation may happen instantly, on a large scale,” Olejnik said.

The risk is particularly acute for small websites run by individuals or organisations with limited technical resources, often on shared hosting services where customers do not directly manage the underlying servers. Security experts said such sites could take longer to patch and remain exposed well after fixes become available.

Mass outages

In the Netherlands, several organisations followed the example of the National Cyber Security Centre and took public-facing websites offline, including the Port of Rotterdam, government portal Overheid.nl, the national football association KNVB, the websites for the country’s five largest political parties and several hospital websites.

Danish municipal IT company Kombit said it had shut down several services, including the national school communication platform.

Disruption was even more widespread in Finland, where state IT services provider Valtori said government public network services had been taken offline “as a precautionary measure”.

France’s Interior Ministry said it had placed all of its websites into preventive maintenance. Japanese cloud service provider Sakura Internet said on Wednesday it had suspended a database appliance function.

Apple on Wednesday said it will have ‘limited’ numbers of its folding iPhone Duo phone available for walk-in customers when the device launches on Friday, after initial online orders sold out in minutes and pushed delivery times for some customers to January.

Apple announced its first folding phone in September, with analysts expecting it to quickly come to dominate a niche segment where rivals such as Samsung Electronics and Huawei Technologies have sold premium offerings for years.

But the iPhone Duo is also a more complex product than standard candy-bar iPhones, with a tight-fitting hinge that analysts believe may take time for Apple to learn to manufacture in high volumes.

“On Friday morning, our teams look forward to welcoming customers at Apple Stores to experience iPhone Duo and the incredible iPhone line-up for themselves,” Apple said in a statement.

“Apple Stores will have limited iPhone Duo available for walk-in customers, and we’re working hard to get this revolutionary new product into customers’ hands as quickly as possible,” it said.

The availability of walk-in units will vary by country, Apple said.

Online order pickup and limited walk-in purchases will be available in the United States, Australia, Canada, Mexico and much of the UK and Europe.

Other regions will only have iPhone Duo units available for customers who already bought them online, including mainland China, France, Hong Kong, India, Japan, Malaysia, South Korea, Taiwan, Thailand and the UAE, Apple said.

On the China-governed island of Macau, the iPhone Duo will be available for walk-in customers only, with limited inventory, Apple said.

OpenAI said on Wednesday it was expanding advertising on ChatGPT to 26 more countries, including Pakistan, ​bringing the total to 89 as ‌the AI company beefs up its advertising business to boost revenue ahead of a potential initial public ​offering.

The company said in August its ads ​business had reached an annualised revenue run ⁠rate of $1 billion.

OpenAI began testing ads in ChatGPT ​in the US earlier this year, and ​more than 100,000 advertisers have since run campaigns on the platform, the company said.

The expansion adds 14 more ​Latin American countries, including Argentina, Chile, Colombia ​and Peru, following launches in Mexico and Brazil.

Ads are also launching in markets across Europe, the Middle East, Africa and Asia, including Nigeria, South Africa, Serbia, Ukraine, Cambodia, Bangladesh and Pakistan.

Advertisers can access ​ChatGPT ads ​in the ⁠new markets through technology partners, or get self-service access via Ads Manager ​on the company’s platform.

Ads will appear ​only ⁠on ChatGPT’s Free and Go plans, while Plus, Pro and Enterprise subscriptions will remain ad-free.

In ⁠September, ​OpenAI introduced AI-powered tools for ​advertisers and began testing business-sponsored agents with select US advertisers.

When Justice Department (DOJ) staffers arrived in Minnesota this summer to monitor the state’s primary election, they found themselves under scrutiny as well.

Minnesota officials deployed about 40 state employees, working in pairs, to track the DOJ lawyers as they travelled through two counties during the August vote.

The monitoring effort reflected mounting tensions between Minnesota and the Trump administration over elections and immigration.

Democratic Secretary of State Steve Simon said his office is likely to continue coordinating with the state attorney general’s office to shadow federal monitors during the November 3 midterms, when control of Congress is at stake. California has launched a similar programme.

While Simon acknowledged the DOJ monitors were not disruptive, the moves by Minnesota and California nevertheless underscore the unease in Democratic-led and some Republican-led states about the DOJ’s plans to deploy about 1,000 monitors in all 50 states on Election Day, roughly triple the number in the last midterm election. The deployment would be the largest observation effort in the department’s history.

The Trump administration has taken an increasingly aggressive approach to election oversight, pressing states for voter-registration data and arguing that stricter measures are needed to ensure public confidence in the vote. Critics, including both Democratic and some Republican election officials, view the moves as federal overreach.

California Attorney General Rob Bonta, a Democrat, said in an interview that “they are the source of interference,” referring to the federal government. “They are the ones that are intimidating and creating the suppression.”

Justice Department officials accuse critics of fear-mongering about the monitor programme, saying it will focus on compliance with civil rights laws as in prior elections.

DOJ spokesperson Kiersten Pels said the monitors will be trained not to interfere with election processes and will focus on countering voter intimidation and protecting access.

The DOJ has not yet revealed where monitors will be deployed, but department officials said priorities include areas with a history of voter access issues and places with competitive races that could be targets of voter intimidation.

The expanded monitor programme has led several states to issue new guidelines to local election officials and poll workers about the limited authority DOJ observers will have on Election Day.

Some state and local laws allow election officials to prevent DOJ monitors from being present inside polling locations.

DOJ staff can observe voting, speak to voters after they leave polling places and report immediate concerns to local law enforcement or election officials. But they cannot conduct investigations on the spot or otherwise stop anyone from voting.

In Nevada, the chief election official, Democrat Cisco Aguilar, said local law enforcement will be trained to remove any DOJ monitor breaking rules or refusing to leave a polling place if asked.

In Maine, where a key race could help decide control of the Senate, the secretary of state has told local election supervisors to contact the state if federal monitors request permission to observe.

A long-running programme

The Justice Department for decades has dispatched election monitors to document potential civil rights violations, such as polling locations that lack Spanish-language ballots or are inaccessible to people with disabilities.

The Trump administration has reshaped the DOJ’s Civil Rights Division, which runs the monitoring programme, prompting an exodus of career staff and a new focus on election fraud and voting by non-US citizens.

The new emphasis has led some state officials, rights groups and former DOJ lawyers to fear the expanded programme could be used as a tool to sow doubt about the security of the election, in which Democrats are widely expected to gain control of the House of Representatives and possibly the Senate.

“There’s never been a time when DOJ’s presence would have been viewed as this much of a threat,” said Stacey Young, a former DOJ lawyer who previously worked as an election monitor and now runs Justice Connection, an advocacy group that has opposed the Trump administration.

A particular concern among voter rights groups is the department’s plan to deploy criminal prosecutors as monitors, in a break with historical practice. The department has relied on civil lawyers and support staff in the past out of concern that the presence of criminal prosecutors at the polls could make voters apprehensive.

A major civil rights group, the National Association for the Advancement of Coloured People (NAACP), has sued to bar prosecutors and other law enforcement personnel from serving as monitors, arguing the Trump administration’s plans amount to voter intimidation.

A senior DOJ official, speaking on the condition of anonymity to discuss operational details, said voters were unlikely to notice a difference between prosecutors and other DOJ staff.

“Monitors will not identify themselves as prosecutors,” Pels said in a statement, arguing the NAACP lawsuit is based on “unwarranted fear and baseless speculation”.

She said the monitors would document instances of any alleged voting by non-citizens they uncover, a core Trump administration priority that has not historically been a focus of the programme.

“If monitors observe any violation of federal election law, including voting by non-citizens, they record and report it to the department,” Pels said.

The senior DOJ official said monitors would not seek to check voters’ citizenship status on Election Day. Reports from monitors, however, could contribute to investigations after the election, the official said.

It’s unclear what evidence of illegal voting monitors would be able to collect while observing in polling places.

The Trump administration has made voting by non-citizens a centrepiece of its campaign, alleging voter fraud, prosecuting alleged offenders in past elections and seeking to block California from counting some 20,000 mail ballots from voters the administration alleges are likely non-citizens.

Studies have found that the practice is rare, but President Donald Trump and his allies have held up isolated cases as evidence to falsely claim that US elections are “rigged.”

Few incidents in primaries

The DOJ has said it monitored hundreds of polling places in 11 states during this year’s primary elections. Few incidents were reported, but in Wyoming, the state’s Republican governor, Mark Gordon, asked the state attorney general to probe what he described as aggressive conduct by DOJ monitors, including requests to examine voting machines.

The DOJ official said monitors only asked about the machines to inquire about access for people with disabilities. A spokesperson for Gordon said disagreements remained about the episode.

Officials in several states told Reuters they had worked successfully with DOJ monitors in prior elections and did not anticipate disruptions this year.

Two Minnesota counties, Hennepin and Ramsey, invoked state law to keep DOJ monitors from within 30 metres of polling places during the primary election in August.