Serious security vulnerabilities in PHP, a programming language used by millions of websites, have triggered a global cybersecurity alert after researchers used artificial intelligence (AI) tools to uncover flaws that had gone undetected for years.

Governments, cybersecurity agencies and technology companies have urged website operators to install emergency security updates or temporarily take vulnerable systems offline to prevent potential attacks.

Cybersecurity firm Wiz, whose researchers helped identify the flaws, described them as the most severe vulnerabilities uncovered using AI. OpenAI, whose technology was used in the research, called the discovery one of the most significant cybersecurity issues in recent years.

PHP, which stands for PHP: Hypertext Preprocessor, is widely used to develop websites and online services, including Wikipedia, e-commerce platforms and websites built using WordPress.

The vulnerabilities could allow attackers to take control of affected servers without authentication and access sensitive information, raising concerns about the security of millions of websites.

The alert has disrupted online services worldwide, with several government portals, public institutions, gaming platforms and online forums temporarily taken offline as a precaution.

Wikimedia, the organisation behind Wikipedia, shut down some systems temporarily. Several public websites in Finland, the Netherlands and Scotland were also taken offline, including sites operated by Edinburgh Council and the University of Geneva.

Cybersecurity researchers have warned that smaller organisations with limited resources could face greater risks, particularly if their websites are not regularly maintained.

PHP developers released security updates on Wednesday and urged users to install them immediately.

The US National Security Agency advised organisations to temporarily take affected systems offline if they could not apply the updates promptly, warning that the vulnerabilities could provide attackers with direct access to databases.

The UK’s National Cyber Security Centre issued similar advice, urging organisations to check their systems for unauthorised access and hidden backdoors. Cybersecurity authorities in the European Union, Singapore and Australia also issued warnings.

Japanese Prime Minister Sanae Takaichi urged operators of publicly accessible websites to check whether their systems used PHP and apply the necessary fixes.

Meanwhile, Amazon said it had faced multiple attempts to target its systems days before the vulnerabilities were publicly disclosed. It remains unclear how the potential attackers learned about the flaws.

Researchers at cybersecurity firms Calif and Wiz used advanced AI tools to examine software code and identify weaknesses more quickly than traditional methods.

Salil Kanhere, a cybersecurity researcher at UNSW Sydney, said complex software could contain security flaws that remain undetected for years. Advances in AI had made it easier to identify such weaknesses, he said.

OpenAI said the discovery highlighted AI’s potential to identify security vulnerabilities while also raising concerns that attackers could use the technology to develop malicious tools and exploit software weaknesses.

The company said it had released a programme to help check whether PHP systems were secure.

Experts have urged website operators to install the latest PHP security updates, monitor software providers’ announcements and check for signs of unauthorised access.

Users have also been advised to follow security guidance from affected services, change passwords when necessary and remain alert to phishing messages that exploit the incident to steal login credentials and other sensitive information.