International governments and cyber-security agencies have urged website operators and organizations to address two critical security flaws discovered in the PHP programming language. The vulnerabilities, which went undetected for more than a decade, affect a programming language that quietly powers a massive portion of the global internet.
Following the release of an emergency fix on Wednesday afternoon, multiple cyber-security authorities advised organizations unable to apply patches immediately to consider taking their web pages and systems offline.
The discovery was made by cyber-security researchers at Calif and Wiz utilizing advanced frontier AI models through a program initiated by OpenAI called Patch the Planet. Wiz described the flaws as some of the most severe vulnerabilities ever discovered by artificial intelligence, noting that frontier models enabled researchers to develop and adapt working exploits across multiple applications within hours. Although the PHP Foundation intended to release its discovery and complete patch later in the month, details of the flaw leaked on social media on Tuesday, forcing an expedited public announcement.
Global response and website outages
The scale of the threat prompted immediate precautionary measures worldwide. The Finnish government temporarily shut down its public web services, while the Netherlands took its national government website and the portal for the Tweede Kamer lower house offline. In the United States, the National Security Agency advised organizations via social media to take systems offline if they could not update with the fix, warning that the vulnerabilities often provide a direct path to server file systems and databases.
Major public platforms also enacted precautionary measures. The Wikimedia Foundation took down several systems, causing temporary access disruptions across Wikipedia. Edinburgh council’s website and online pages for several BBC programmes, including Doctor Who and The Traitors, became inaccessible, while platforms like art sharing site DeviantArt reported being temporarily down for maintenance. Furthermore, Japan’s Prime Minister Sanae Takaichi urged administrators to check if their publicly available websites operated on PHP.
Pervasive nature and emerging threats
Cyber-security experts have emphasized the immense challenge posed by the pervasive use of PHP. Industry trackers note that PHP powers WordPress, Drupal, Joomla, Magento sites, shared hosting platforms, and various hidden backend systems. Don Smith of the Sophos Counter Threat Unit cautioned that the flaw would likely become a priority target for hackers, noting that the immediate challenge lies in identifying every hidden instance where PHP is running.
The European Union Computer Emergency Response Team (CERT-EU) stated that the risk scores indicate potential for unauthenticated remote code execution, which could allow malicious actors to install malware and disrupt operations. Cloudflare chief technology officer Dane Knecht reported observing early attacks emerging, prompting infrastructure providers to update mitigations. While the PHP Foundation issued updates for recent software versions, experts stressed that continuous monitoring for third-party software updates remains vital for complete protection.
