Websites around the globe have gone dark after a serious vulnerability was found in a computer language used to build much of the world wide web.

Belgian, Dutch, Finnish, French and German sites were among those that governments took down temporarily as they scrambled to patch the critical weakness in PHP, a language used by almost 70% of websites.

The vulnerability in the programming language, which became public on Tuesday, sparked warnings from national security agencies in Washington and London. It means millions of websites will need to be fixed. One internet infrastructure expert said Russian state actors or organised criminals could exploit the flaw to carry out cyber-attacks.

Wordpress, one of the most common website systems, uses PHP, as does Wikipedia, the messaging software Slack and – at least historically – much of Facebook. The Wikimedia Foundation said it had taken down several systems on Wednesday as a precautionary measure until they could be patched.

The organisation behind the language issued a patch on Wednesday after researchers testing cyberdefences discovered the flaw. The US National Security Agency told all organisations using PHP to take their systems offline if they were unable to patch them immediately. It said the vulnerability could “provide a direct path to the server’s file system or database”.

The UK’s National Cyber Security Centre gave similar advice and told organisations to check for “backdoors installed by an attacker”.

Prof Alan Woodward, a cybersecurity expert at Surrey University, said: “It was very surprising and troubling because of the extent to which PHP was used around the world. PHP issued a patch very quickly. The big thing is for everyone using it to get that in to make sure their systems are safe.

“The troubling part is there is going to be a long tail of websites who may not be maintained as well and they are going to remain vulnerable, which means we may see weeks and months of ongoing attacks. For the big juicy targets, I hope to goodness they are being patched quickly.”

Woodward said there was a window of opportunity for bad actors. “There is this race and some people unfortunately don’t even know they are in the race.”

OpenAI said it led a coalition of researchers that discovered the flaw and claimed “frontier AI” had been key. The researcher who found the weakness, however, said they did not use models that were not available to the general public.

In the UK, websites belonging to Edinburgh, Bristol and Oxford councils were taken offline. In France, local government websites including that of the Paris police prefecture went offline on Wednesday, as did in the Netherlands the national digital identity service, the website of the house of representatives and the site of the national cybersecurity centre.

The Australian Signals Directorate was temporarily affected by the outage overnight local time, with the national cyber defence agency noting other government websites may have been similarly affected.

Michał Woźniak, an internet infrastructure expert, said: “There’s going to be a lot of automatic exploitation of this.” The bug might allow cryptocurrency miners to exploit vulnerable servers at other people’s expense, he said.

He also said large crime organisations and Russian state actors could use the vulnerable sites as a launching pad from which to conduct distributed denial of service (DDoS) and other cyber-attacks.

The issue highlighted the poor state of internet infrastructure, Woźniak said, something that was being brought to light by advancing AI models but that had been a long-developing problem. The underlying vulnerabilities the researcher found were decades old.

“This is an environmental problem in an industry where there’s an incentive to move fast and make changes,” he said. “There’s an incentive to deploy a thing and then never update it and not think about maintenance.”