In brief
In a surprising turn of events, AI‑driven security researchers uncovered critical flaws in PHP that could compromise up to 70% of the internet. The discovery prompted governments and agencies to pull sites offline, from the Finnish public web services to BBC programmes, as they waited for patches. Early signs of attacks have emerged, raising fears that attackers may already have gained footholds. The incident highlights the pervasive nature of PHP in web infrastructure and the necessity for rapid, coordinated responses across the globe.
International governments and agencies have urged websites to address two critical cyber‑security flaws in PHP, the language powering much of the web.
The vulnerabilities, discovered by AI teams at Wiz and Calif, were released to the public on Wednesday. They could allow unauthenticated remote code execution, opening doors for attackers to plant malware and seize control of servers.
In response, Finland temporarily shut down its public web services while the BBC and the Edinburgh council removed pages from hermes. The US National Security Agency warned organisations to take sites offline if they couldn’t apply the fix immediately.
Japan’s Prime Minister urged citizens to check for PHP‑based sites, and the Wikimedia Foundation said it was temporarily pulling content to safeguard data. The incident has caused disruptions across WordPress, Drupal, Joomla, and countless other platforms that rely on PHP.
Cyber‑security firms Huntress and Sophos warned that PHP’s ubiquity makes it a “priority target” for hackers, and early attacks are already being reported by Cloudflare.
The PHP Foundation’s patch is only available for the latest versions; older releases, including PHP 5 and 7, are at highest risk. Government bodies worldwide, from the Netherlands’ NPI to the UK’s NCSC, are urging rapid deployment of the update.
