Critical vulnerabilities discovered in the PHP programming language have triggered widespread emergency action across the internet, forcing governments and major organizations to temporarily shutter public web services. The flaws, which allow for potential unauthenticated remote code execution, have prompted urgent calls from international security bodies to apply immediate patches or take affected systems offline. It added an internal researcher at the company had also discovered the issue around the same time as the other firms. Though is unable to verify that figure, it has estimated “roughly 70%” of the internet is affected. According to the European Union Computer Emergency Response Team (CERT-EU), The risk scores given to the vulnerabilities “indicate the potential for unauthenticated remote code execution”.
Cyber-security firm Wiz described the flaws as the most severe vulnerabilities ever discovered through artificial intelligence, noting that the technology is significantly altering the cyber-security landscape.
The discovery was made by researchers at Calif and Wiz, who were participating in the Patch the Planet program initiated by OpenAI. Using advanced AI tools, the researchers identified issues that had remained undetected for more than a decade, successfully developing and adapting exploits within hours. According to frontier models were critical to making this process practical, enabling us to develop and adapt working exploits across multiple applications in hours,” Wiz, In a blog post.
OpenAI characterized the find as one of the most impactful security events in recent memory. While the PHP Foundation originally planned a coordinated release later this month, a social media leak on Tuesday forced a premature announcement. The vulnerabilities, which may affect versions dating back to PHP 5, have prompted the PHP Foundation to issue updates primarily for newer versions, leaving users on PHP 8.1 or older with the urgent task of upgrading. According to it is not yet clear which versions of the programming language are affected, but CERT-EU, It could affect all versions of it dating back to PHP 5 onwards – which launched in 2004.
The scale of the disruption is extensive, with Finland taking its government web services offline and the Netherlands reporting that its cyber-security agency and national parliament were among those moving to secure their platforms. In Japan, Prime Minister Sanae Takaichi issued a public appeal for website operators to verify if their infrastructure relies on PHP. The Wikimedia Foundation also confirmed it was patching its systems, resulting in intermittent access issues for Wikipedia users. External, Japan’s Prime Minister Sanae Takaichi urged people to check if their publicly available websites ran on PHP, and in a post on X. It is used on servers to implement what you see when you visit websites.
Organizations including the UK’s National Cyber Security Centre (NCSC) have advised that if immediate remediation is not feasible, systems should be kept offline until full mitigation occurs. We have taken down a number of other systems as a precautionary measure until they can be safely patched,” it said.
Similar warnings have been issued by the US National Security Agency, EU officials, and Australian cyber-security authorities.
Experts from the Sophos Counter Threat Unit highlighted that PHP’s pervasive presence—powering content management systems like WordPress, Drupal, and Magento—makes it an immediate target for attackers seeking a foothold in server file systems or databases. These vulnerabilities often provide a direct path to the server’s file system or database,” it wrote. It âquietly powers WordPress, Drupal, Joomla, and Magento sites, shared hosting platforms, control panels, and an awful â lot of software that doesn’t even advertise that it runs PHP under the hood,” cyber-security co. According to he, It was crucial that organisations looked out for signs that an attacker “might have already have gained a foothold”. According to cyber-security expert Don Smith, from the Sophos Counter Threat Unit,, This would “likely be a priority target” for hackers.
The technical challenge facing organizations is not limited to patching; it involves identifying every instance where PHP may be operating, including within third-party appliances or hidden services. Dane Knecht, chief technology officer at Cloudflare, reported that his firm is already monitoring early attacks as new exploitation vectors emerge. For its part, the White House has confirmed that federal agencies are coordinating with top AI labs to accelerate the development of protective measures. They have not confirmed a link to PHP – has approached them for comment.
While specific entities such as Edinburgh council and several programs have taken pages offline, links to the specific PHP vulnerability remain under investigation for some of these cases. As well as the online homes for several programmes including Doctor Who and The Traitors, edinburgh council’s website has also become inaccessible.
Other sites, such as the creative platform DeviantArt, have notified users of maintenance downtime without explicitly citing the security crisis.
The NCSC stressed that after updating, organizations must maintain continuous oversight of third-party software vendors to ensure that integrated services are also protected against lingering threats.
