Government portals, hospital websites and school services went dark worldwide on Wednesday as operators scrambled to protect against two critical software flaws.

The disruptions stemmed from vulnerabilities in PHP, a programming language used to power up to 70 percent of the world’s websites.

Websites and online services have been temporarily taken offline in several countries, including the Netherlands, Finland, France and Denmark, over fears of an attack.

The US National Security Agency (NSA) and FBI advised organizations using PHP to take affected systems offline if they could not immediately install security updates. 

Major US websites and services, including Etsy, Wikipedia and NASA.gov, use PHP-based technology, illustrating the software’s reach across shopping, information and government services.

Cybersecurity agencies in Europe, Australia, Japan and Britain have also urged PHP users to update immediately or take affected websites offline until the fixes can be applied. 

The flaws could allow hackers to take control of affected servers without needing a password or account. A successful attack could let criminals steal information stored on a server or turn a trusted website into a tool for launching attacks against its visitors.

Cloudflare, which provides internet infrastructure and security services, reported signs of attacks as website operators raced to install the emergency fixes.

Tiffany Farriss, the interim chief executive of the ​Drupal Association, said: 'All servers using any version of PHP released in the last 20 years will be vulnerable.

'This issue impacts the majority of the Internet.'

According to data from Censys, the internet intelligence firm, about 1.5 million out ​of 2.6 million hosts report running a version of PHP for which there is no fix. 

Both flaws involve how PHP handles a server's memory. One can cause the software to mishandle information when it encounters memory problems, while the other allows it to reuse information from memory that has already been released.    

The extent of the attacks remains unclear, although cybersecurity platform Patchstack said it had received 'reports of active exploitation.'

The security team that maintains PHP reportedly released patches to fix the problem at 10am ET. 

Website operators now face a race to install the fixes before hackers can use AI to study the updates and work out how to attack systems that remain unprotected.

Thai Duong, chief executive of Calif, the security company that discovered the vulnerabilities, told The Wall Street Journal: 'Some dude on Twitter could take the patches and run AI against it and post some exploit script.' He added: 'All hell will break loose.'

CERT-EU, the European Union's technical cybersecurity advisory body, said: 'Organizations should consider isolating internet-facing applications from public networks until a fix is available.' 

In the Netherlands, several organizations followed the example of the National Cyber Security Center and took public-facing websites offline.

Those included the Port of Rotterdam, government portal Overheid.nl, the national soccer association KNVB, the websites of the country's five largest political parties and several hospital websites.

Danish municipal IT company Kombit said it shut down several ⁠services, including ​the national school communication platform, a spokesperson told Reuters.

Disruption was even more widespread in Finland, where state IT services provider ​Valtori said government public network services had been taken offline 'as a precautionary measure.' 

France's Interior Ministry said it had temporarily taken local government administrative websites offline while awaiting a security fix.

AI-assisted hacking campaigns, which have proliferated in recent weeks, could magnify the threat, said Lukasz Olejnik, a visiting senior research fellow at King's College London.

'The scale is huge,' Olejnik said. 'And with AI, exploitation may happen instantly, on a large scale.' 

PHP is a programming language used to run websites. When a visitor loads a page, a server running PHP assembles the content and sends it to the browser. 

Rather than target victims individually, attackers could scan ⁠the internet for systems running vulnerable versions of PHP.