Governments and companies around the world rushed to patch two critical flaws in widely used technology, keeping some websites offline as a precaution against hackers trying to use the flaws for cybercrime. 

Banks, airlines and governments across Europe, Asia and the Americas on October 22 pulled down websites to avoid being hacked through vulnerabilities in an open-source programming language that underpins huge swaths of the internet.

Artificial intelligence models helped find the vulnerabilities in PHP that could expose users to cyberattacks. Organizations started taking their websites offline on October 21 as a precaution, after researchers disclosed the flaws, resulting in national cybersecurity agencies urging firms to install available fixes to mitigate the risk of hacking. 

Governments and organizations in countries including Austria, the Netherlands, Finland, France, Denmark, Australia, Canada, Germany, Japan and Belgium were among those to pull websites offline on Wednesday as they worked to implement fixes. In the U.S., the White House was also engaged with U.S. federal agencies and critical infrastructure firms on the issue.

The PHP vulnerabilities had existed undetected for more than a decade, but AI tools helped quickly identify a fix for them, according to researchers at Alphabet Inc.-owned cybersecurity company Wiz. They discovered the flaws with the help of several AI tools, and collaborated with OpenAI and the cybersecurity firm Calif on the work.

“With frontier AI models and the right tools, a single researcher completed in a week what previously would have taken a world-class team months of work,” the report said.

Taking sites offline means attackers can’t reach and exploit a flaw while it’s being fixed. The developers responsible for maintaining PHP released software updates to patch the flaws on October 21, urging users to adopt those changes immediately. 

Matthew Prince, chief executive officer at the cybersecurity company Cloudflare Inc., said in a post on X that his firm had identified thousands of attempts to exploit the PHP vulnerabilities 10 hours before they were publicly announced. Within two hours of the announcement, Prince said, the hacking attempts were in the hundreds of thousands, and later increased into the millions. 

It’s not clear how many of those attempts, if any, were ultimately successful in breaching any victims.

“Literally, we’re seeing millions of attempted attacks using this flaw now across all of our network every single minute of every single day,” he said on October 22, during an interview with Bloomberg TV. 

The discovery of such critical flaws is poised to accelerate, as AI models increasingly scour software for weaknesses and flaws in computer code. The number of known vulnerabilities uncovered in 2026 is on pace to roughly double the number revealed in 2025, according to the U.S. National Vulnerabilities Database, a government project that tracks software flaws. 

However, there’s little indication that cyberattacks are rising as a result of those disclosures, as many of the flaws found this year were uncovered by the technology companies themselves. Of 433 vulnerabilities found in Google Chrome in July, 401 of those were reported by Google. The U.S. Known Exploited Vulnerabilities repository hasn’t reported a meaningful uptick in known cyberattacks. 

On October 22, more than 30 government services in the U.K. remained offline while PHP security updates were applied, Elizabeth Lloyd, the U.K. minister for space, cyber and regulatory reform, said in a statement to the House of Lords. Telecommunications operator Orange said on the same day that it was suspending access to some of its websites and applications while it deployed security patches for the vulnerabilities.

PHP is used on nearly 70% of websites for which the internet research project W3Techs could identify the programming language, according to the researchers. There are more than 22 million “exposed instances” of PHP across the web, according to Lee Klarich, a researcher with U.S. cybersecurity company Palo Alto Networks Inc., who said they include servers, databases and applications. 

The flaws in PHP could let an attacker take control of affected sites, but reports of attempted exploitation don’t mean that digital intruders succeeded in breaching organizations. 

Hackers already attempted to exploit PHP’s security holes in the days before the flaws were made public, according to researchers at Amazon.com Inc. In a report published on October 21, Amazon said an unknown “threat actor” had somehow obtained information about and tried to make use of the vulnerabilities prior to the public release of details about them.

More than a third of the 22 million vulnerable and internet-exposed systems are running legacy software that can’t be patched, said Jack Hughes, head of digital forensics and incident response for EMEA for Palo Alto Networks’ Unit 42.

In Japan, several banks and airlines took services offline. Mizuho Financial Group Inc.’s bank and security arms halted services, and said they were taking emergency steps to improve security. Regional lender Shizuoka Bank suspended its website and app, while Mitsubishi UFJ Financial Group Inc. companies halted some online services. 

The window between security holes becoming known and organizations implementing a patch was critical and required swift action by any organization affected, said Matt Hull, vice president of cyber intelligence and response at NCC Group.

“There is a real possibility that vulnerable systems could already have been compromised, including the creation of backdoors,” said Hull.