AI-discovered security flaws trigger website shutdowns worldwide

Security flaws in PHP, the programming language behind many websites, have led authorities in several countries to take public websites offline while they prepare software updates. The disruptions have hit Finland, the Netherlands, France, Denmark and other countries. The headline attributes the discovery of the flaws to AI.

The vulnerabilities carry a severity rating of 9.2 out of 10. They let attackers run commands remotely on affected servers without needing to authenticate. PHP supports content management platforms including WordPress, Drupal and Joomla, and WordPress alone powers roughly 40 per cent of websites worldwide.

In the Netherlands, the national cybersecurity agency's website went offline, along with government portals and services run by the Port of Rotterdam. France's Interior Ministry put its websites under preventive maintenance. Denmark suspended services including a national school communication platform. In Britain, local authority websites in Edinburgh, Bristol and Oxford were temporarily unavailable.

The scale of exposure is large. Internet intelligence company Censys estimated, as reported by Reuters, that about 1.5 million of 2.6 million identified PHP hosts were running software versions for which no patch was available.

The episode matters because the affected software underlies so much of the web, and the flaws allow unauthenticated remote command execution. Governments chose to suspend public services rather than leave servers exposed while fixes were prepared, which shows how directly the vulnerabilities are affecting everyday public services, including in Denmark and the wider Nordic region.