Global Websites Taken Offline After Critical PHP Security Flaws Discovered

International governments and cyber-security agencies have urged website operators to address two critical flaws in a widely used programming language. The vulnerabilities affect PHP, which powers a massive portion of the internet.

The Discovery of Severe Flaws

The vulnerabilities were discovered by researchers at security firms Calif and Wiz. These companies participated in a program started by OpenAI known as Patch the Planet, which granted them access to advanced artificial intelligence tools to find and fix web development language flaws. Cybersecurity firm Wiz described the issues as the most severe ever discovered by AI technology, while OpenAI stated the finding ranked among the most severe cybersecurity complications witnessed lately. An internal researcher at OpenAI uncovered the exact bug concurrently as well.

The underlying bugs went undetected for more than a decade before being spotted in August following a brief couple of weeks utilizing advanced AI tools. Frontier models allowed researchers to engineer and tailor functional attack methods across numerous software platforms within hours. Wiz estimated that roughly seventy percent of the internet is affected by the issue, though BBC News could not verify that figure. The PHP Foundation planned to unveil its discovery later this month alongside a complete patch, but technical details leaked on social media, forcing a rushed public announcement.

Global Disruption and Website Shutdowns

Multiple cyber-security agencies recommended that organizations unable to apply immediate fixes should take their systems offline. This advisory led various public bodies and private organizations to pull pages offline. BBC News reported that the Finnish government temporarily shut down its public web services, and the Netherlands' cyber-security agency took its website offline. The US National Security Agency released comparable directives via X instructing entities to disconnect networks if patches could not be implemented. Meanwhile, the White House stated that federal authorities collaborated alongside premier AI developers to accelerate a resolution. In Japan, Prime Minister Sanae Takaichi urged people on X to inspect whether their accessible online portals utilized PHP.

The Wikimedia Foundation stated it disconnected multiple operations as a safety precaution while awaiting secure patches, causing temporary access issues for parts of Wikipedia. Edinburgh council's website also became inaccessible, along with online homes for BBC broadcast properties such as Doctor Who and The Traitors, though they did not explicitly confirm a link to PHP. The art platform DeviantArt stated it was temporarily down for maintenance without specifying the reason. In the Netherlands, the Dutch public health agency along with the lower house of parliament, the Tweede Kamer, also took their websites offline. E-commerce giant Amazon noted it faced multiple malicious intrusion sequences days prior to public notification, though how potential attackers knew about the vulnerability remains unknown.

Technical Risks and Expert Warnings

Cybersecurity companies and experts warned that the flaws provide a direct path to server file systems and databases. CERT-EU stated that the risk scores indicate potential for unauthenticated remote code execution, which could grant malicious actors the ability to deploy malicious software and disable web portals. Cybersecurity company Huntress noted that PHP quietly powers WordPress, Drupal, Joomla, Magento sites, shared hosting platforms, and control panels without necessarily advertising its presence. Sophos Counter Threat Unit expert Don Smith told the BBC that the issue would likely turn into a primary focus for malicious operators. The primary difficulty centers on discovering and overseeing every concealed instance of PHP operating underneath public web pages, content management systems, and third-party software.

Cloudflare chief technology officer Dane Knecht reported seeing early attacks emerging while updating mitigations against new vectors. Paul Spain of Gorilla Cyber Security explained that PHP collects and presents information for users on sites like Wikipedia, but left systems exposed to attackers taking control of web servers without authentication and stealing sensitive data. University of Adelaide researcher Jill Slay warned that weaponization by hackers or foreign actors to seize private data would prove disastrous. UNSW Sydney researcher Salil Kanhere noted that public dissemination of technical data implies an expected increase in attack vectors in the upcoming period.

Action Required and Recommendations

The PHP Foundation rolled out emergency patches for the latest versions of the software. However, the update was issued only for recent versions, with administrators operating PHP 8.1 or prior being strongly advised to migrate. CERT-EU indicated the issue could affect all versions dating back to PHP 5, which launched in 2004. Cybersecurity agencies in the UK, US, EU, Australia, and Singapore urged immediate action. The UK's National Cyber Security Centre advised organizations to check for backdoors installed by attackers and continuously monitor third-party vendors once updates are installed. Researchers also reminded the public to remain vigilant against potential phishing messages exploiting the widespread publicity surrounding the incident.

Syed Aqeel — verified this story.