In brief
A set of critical vulnerabilities in the PHP programming language, discovered by AI‑powered security firms, prompted international authorities to advise sites to apply a patch or take their servers offline. Major broadcasters, government portals, and a key online encyclopedia temporarily shut down pages. The flaws, which potentially allow attackers to access servers and databases, were found to affect an estimated 70% of the web, though the data is unverified. Cyber‑security bodies worldwide, including the US NSA and the UK NCSC, are urging rapid mitigation and monitoring for emerging attacks.
International governments and agencies have urged organisations to immediately patch or temporarily shut down websites running the PHP language after a set of critical vulnerabilities were discovered by AI‑driven security companies.
The flaws, identified by firms Calif and Wiz, were formally classified as the “most severe vulnerabilities ever discovered” in PHP, which powers a wide range of sites including WordPress, Drupal, Joomla and many hosting platforms.
Recipients of the patch, issued on Wednesday afternoon, have been warned that failure to update could result in unauthenticated remote code execution, potentially giving attackers direct access to server files or databases.
Amid the advisory, several high‑profile sites have gone offline. The Finnish government’s public web services, BBC programmes such as Doctor Who and The Traitors, and the Edinburgh council’s site were all taken down until a fix could be applied.
The US National Security Agency and UK National Cyber Security Centre (NCSC) issued similar guidance on X, urging organisations that could not patch immediately to consider tactical shutdowns. The White House also announced that federal agencies are collaborating with AI labs to accelerate remediation.
Japan’s Prime Minister Sanae Takaichi called on citizens to verify whether their publicly accessible websites use PHP, and the Wikimedia Foundation confirmed it had already taken down several systems as a precaution.
Security experts explain that because PHP may run behind seemingly unrelated software, locating every instance of the language within an organisation’s infrastructure can be challenging. The risk score given to the vulnerabilities indicates the potential for unauthenticated remote code execution, a threat that could enable attackers to install malware or bring entire websites down.
The PHP Foundation has released a patch for the latest PHP versions, but security teams are advised to upgrade to PHP 8.1 or newer. Older versions, dating back to PHP 5 launched in 2004, are also potentially exposed.
As the internet grapples with the scale of the threat, early attacks have already been reported. Cloudflare’s chief technology officer Dane Knecht said the company is updating mitigations amid emerging attack vectors.
This incident underlines the growing role of AI in identifying and exploiting software weaknesses, while also highlighting the urgent need for rapid, coordinated cyber‑security responses across the globe.
