The PHP Foundation released the fixes, and the National Security Agency warned that the bugs, present in every version since PHP 5 in 2004, could let attackers reach a server's file system or a web application's database.
OpenAI says the security firm Calif found one flaw with its GPT-5.6 Sol model through the company's Patch the Planet program.
Google's Wiz team separately reported multiple PHP vulnerabilities, using its Wiz Atlas security agent, Gemini 4 Argon and GPT-5.6 Sol.
OpenAI has nicknamed the problem "PHP2SHELL" and says no exploits in the wild have been reported.
Wikimedia took supporting tools offline and confirmed that a Wikipedia outage was tied to the issue.
4chan went read-only, and Fur Affinity, Miraheze and Pinboard announced precautionary shutdowns.
Reuters identified Dutch government sites among those taken down, and Finnish, Belgian, French and German public sites also underwent preventive shutdowns.
The NSA said sites that cannot be patched immediately should be taken offline.
Wiz warned that the flaws were once too hard to exploit but that large language models could help attackers adapt exploits to different PHP versions and configurations.
PHP 8.1 and older are no longer supported, so those sites face upgrades, with PHP 8.5.12 the recommended target.
WordPress said the issue is not specific to its software and that site owners must patch their servers with their hosts.
OpenAI says it led a coalition of maintainers, researchers and security companies for two months, working with U.S. agencies including CISA. President Greg Brockman said the bug had existed for 14 years and that planned Oct. 22 disclosure moved up a day after details leaked. He called the current process for handling such bugs "slow and manual" and said it will not scale as AI improves at finding flaws. OpenAI is seeking feedback on a new coordination process, including one idea in which governments or other authorized defenders scan for vulnerable systems, warn owners and, in extreme cases, patch them. The company has committed $1 billion toward subsidized security tools for organizations protecting essential services and is releasing a tool to check for vulnerable PHP versions. Everyday users do not need to install anything; for most, the effect should be temporary site outages.