The developers of the PHP programming language, which is extensively used across the internet, said on Wednesday a set of new updates fixing two previously identified critical vulnerabilities was now live.
It strongly encouraged users to update software immediately - leaving tech teams around the world scrambling to patch the critical flaw.
Those unable to apply key fixes should consider taking their websites down, UK and international cyber security officials have warned.
PHP is used by almost 70% of websites, according cyber security firm Cloudflare, and underpins popular platforms such as WordPress and Magento.
AI agents helped uncover the vulnerabilities.
OpenAI, which runs ChatGPT, said in the past two months it has been leading a team of researchers to address the flaw in PHP, and supported its developers as it led the fixes.
The company described the incident as "one of the most impactful security issues in recent memory", adding that while AI can help to uncover issues, it can also aid attackers.
The Office for Budget Responsibility (OBR) in the UK said it had taken its website offline "in view of the critical security issues affecting PHP".
While websites linked to French, Danish, Finnish and Dutch governments all appeared to go offline on Wednesday as organisations rushed to protect their systems. Some are now back up and running.
Concerns have escalated in recent days that websites running software would be exposed to serious cyber intrusions.
PHP said both vulnerabilities were rated 9.2 out of 10 on the CVSS v4.0 severity scale.
Read more:
Speaker scolds government for treating media as 'more important' than MPs
Australian MP has both legs amputated, husband confirms
How countries were affected
Earlier France's Interior Ministry said it had placed all of its websites into preventive maintenance. Users visiting French government websites were told there was "ongoing maintenance".
In the Netherlands, several organisations took public-facing websites offline, while Danish municipal IT company Kombit said it had shut down several services, including the national school communication platform.
The Czech government took its website offline on Wednesday evening.
And disruption was also widespread in Finland, where state IT services provider Valtori said government public network services had been taken offline "as a precautionary measure".
Cyber security agencies in Britain and Japan are also among those urging PHP users to update immediately or take websites offline until patches can be applied.
A government spokesperson said: "Work is already under way across government to actively identify and patch any potential exposure.
"We encourage all organisations - private and public, large and small - to follow guidance issued by the NCSC to understand their exposure and take the necessary actions to safeguard their systems."
The US National Security Agency said in a statement the vulnerabilities "often provide a direct path to the server's file system or database," and that if an immediate update was not feasible, organisations should take systems offline for full mitigation.
The Australian Cyber Security Centre (ACSC) urged organisations to identify PHP systems in their environments, prepare to apply patches and monitor applications for signs of malicious activity.
Hacking could become 'more widespread now'
Speaking to Matt Barbet on Sky News' The World, cyber security expert Alp Toker, director at Netblocks, warned the issue was "really impactful because it means that anybody on the web can essentially access your web server if you're running the software, PHP, which is a very, very, popular, web server software".
Mr Toker said disruption caused by nefarious actors so far has been "limited", but he warned it could now become "more widespread".
"So far it's been very limited because the people who found the vulnerability kept it under wraps for quite a while, but in the last few days it has been seen in the wild," he said.
"It is something that is going to become much more widespread now. Now the patch is out, AI agents can learn from that patch and reproduce the attack much more easily."
The Wikimedia Foundation, which runs online encyclopedia Wikipedia, was one company on Wednesday which said it was in the process of addressing security vulnerabilities in the PHP programming language.
While Oxfordshire County Council and Hillingdon Council both separately said their websites were offline as a precaution due to the worldwide issue while they investigate.
On Tuesday, the European Union Computer Emergency Response Team (CERT-EU) said the 9.2 rating indicated a risk of unauthenticated remote code execution, a type of flaw that could allow attackers to run malicious code on vulnerable systems without logging in.
It urged organisations to prepare for the immediate patching of affected assets.
It follows cases in which several notorious murderers avoided facing up to the judge.
The law has already been changed to allow an extra two years for those who refuse, but the Ministry of Justice (MoJ) admitted it's "little deterrent" to people on a very long sentence.
Ministers hope the new penalties will be a tougher deterrent and give offenders "something more to lose".
The MoJ said the plans will allow crown court judges to impose the following penalties:
- Loss of prison privileges for almost three months (84 days)
- Cellular confinement for up to three weeks (21 days)
- Loss of social visits for nearly a month (27 days)
- Restrictions on social visits to once every four weeks, for almost three months (84 days)
Killers who disrupt their sentencing hearing will be subject to the same consequences.
Visits from prisoners' children will be exempt in cases where it's in the child's best interests.
Eighteen to 20-year-olds in young offender institutions will also only face up to 10 days' confinement, while the removal of other privileges will be capped at 21 days.
The MoJ said no penalty can guarantee prisoners attend sentencing but the new rules will "strengthen the consequences".
"Criminals should not be able to pick and choose when they face justice," said prisons minister Catherine McKinnell.
"Refusing to turn up to sentencing is an insult to victims and their families, and offenders must face the consequences."
The victims' commissioner for England and Wales, Claire Waxman, also welcomed the move.
She said the announcement was testament to "the tireless efforts of victims' families who refused to accept that offenders could simply opt out of facing justice".
More from Sky News:
Ex DUP leader accused of raping woman inside parliament
Websites across Europe taken down to protect systems
Ms Waxman added: "Having worked with the families of Sabina Nessa, Zara Aleena and Jan Mustafa, I know how offenders' refusal to attend sentencing hearings compounds trauma and robs families of one of the very few moments of accountability in the justice process.
"Their determined campaigning, alongside that of Olivia Pratt-Korbel's family, helped ensure that this harm could no longer be ignored."
Other killers who have refused to attend sentencing include triple crossbow killer Kyle Clifford, while Southport knifeman Axel Rudakubana was removed from court after shouting and claiming he felt ill.
The plans will be introduced to parliament on Thursday and should come into effect next year.
The Pope had the lower lobe of his right lung removed in surgery on 13 October and was diagnosed with lung adenocarcinoma, the most common form of lung cancer.
He returned to the Vatican on Saturday, four days after the procedure, and is gradually resuming his normal duties.
The Pope's personal physician, Dr Luigi Carbone, and his surgeon, Dr Stefano Margaritora, said in a statement that the results of the tests on tissue removed during his surgery confirmed the initial diagnosis, and the cancer had not spread.
"A subsequent oncology assessment confirmed that no further treatment is necessary," the doctors said.
Pope Leo returned to St Peter's Square on Wednesday, waving to pilgrims and blessing babies from his open-air popemobile.
His weekly audience, the first held by the 71-year-old pontiff since 7 October, followed the normal format.
Crowds started gathering hours beforehand, holding umbrellas under drizzling grey skies.
"The first thing I want to say to you is thank you for the support and prayers," Pope Leo said in his opening remarks, without specifically mentioning his health.
"Thanks be to God for his generosity," he added, as cheers broke out.
More from Sky News:
Nigeria confirms Ebola case as outbreak continues to spread
Man arrested in Pakistan over $126m counterfeit postage scheme
The Pope was originally sent for treatment at Rome's Gemelli hospital for the removal of the small nodule, which he said was spotted early during a recent check-up.
Pre-operative tests had suggested adenocarcinoma, and this was confirmed during the operation, the Vatican said.
The surgery on 13 October lasted around 90 minutes and was described as successful.
The Pope was expected to recover in hospital for about a week, but left earlier than expected.
The pontiff left on Saturday afternoon after doctors said he was "fit for discharge" following blood tests and a chest X-ray.
He then led a traditional noontime Angelus prayer from a window of the papal apartment in the Apostolic Palace overlooking St Peter's Square in Vatican City.
After greeting the crowds gathered on Sunday, he thanked those around the world who have prayed for his health and recovery in recent days.
He said: "I have truly felt your support. Thank you."
It was still unclear whether the US-born pontiff would go ahead with a planned trip to Uruguay, Argentina and Peru, scheduled for 6 to 17 November.
The Pope's lead surgeon said last week there were "no clinical reasons" preventing him from travelling to South America, but the Vatican's secretary of state has indicated the pontiff may need to adjust the pace of his schedule.
The Vatican has provided no indication of Pope Leo's schedule beyond Wednesday.
The Metropolitan Police did not identify the 63-year-old politician but said in a statement it is investigating a report passed on by officers in Northern Ireland.
It said: "On Tuesday October 13, the Met received a report, referred to us by Police Service of Northern Ireland, relating to an allegation of rape in 2016, by a man now aged 63.
"The allegation relates to one victim who is being supported by specialist officers.
"The investigation is in its early stages. No arrests have been made and inquiries remain ongoing."
Earlier this month, Donaldson was given a 15-year sentence for a series of historical sex offences against two women when they were children.
He was convicted of one count of rape, 13 indecent assaults, and four counts of gross indecency, committed between 1985 and 2008.
Donaldson's solicitor has previously confirmed that papers have been lodged for an appeal.
The Oxford University team detected clear biological differences between those who developed the disease and those who didn't.
They also found proteins linked to more aggressive, life-threatening cases of prostate cancer.
Those involved in the study were followed up for about 16 years as scientists measured more than 6,000 proteins in their blood.
Nearly 1,000 people who went on to develop the disease were part of the research, as was a random sample of 1,573 men.
Twelve proteins were identified that were linked to prostate cancer diagnosed more than 15 years later. These included GZMK, which is produced by immune cells involved in recognising and destroying abnormal cells.
Researchers said this suggests the body may be reacting and dealing with the cancer long before it's diagnosed.
Seven proteins linked to aggressive prostate cancer were also identified, including ANKRD1, which was found in cancers that spread or caused early death.
"By measuring thousands of proteins in blood collected years before diagnosis, we can begin to investigate how men who later develop aggressive prostate cancer may differ from men who do not," said study author Dr Zhe Huang, an epidemiologist at Oxford Population Health.
Dr Huang said the results could help improve the understanding of aggressive prostate cancer and find markers to "improve how we assess risk".
One in eight men will be diagnosed with the disease in their lifetime, according to Prostate Cancer UK, and about 12,000 in Britain die from it every year.
Many cases progress so slowly they do not cause significant problems or early death, but some can be very aggressive.
The study also found genes already known to be important in prostate cancer - such as ERBB3, KRAS and NRAS - were linked to aggressive cases diagnosed around a decade later.
More from Sky News:
One man diagnosed with prostate cancer in UK 'every eight minutes'
'Concerning' rise in cancer cases among adults under 50
The findings also said more research was needed before proteins could be used as a test for the disease.
Professor Prabhakar Rajan, from Queen Mary University, said it did not yet show a protein-based blood test could reliably identify who will get aggressive prostate cancer.
Cancer Research UK director of research, Dr Iain Foulkes, said: "While there is more work to do, discoveries like this could pave the way for better ways to identify men at risk and, ultimately, prevent aggressive prostate cancer before it develops."