In brief
Cyber‑security agencies worldwide have warned that a pair of critical vulnerabilities in PHP could allow remote access to servers, prompting governments and major organisations to take sites offline. The flaws were uncovered by artificial‑intelligence tools developed under an OpenAI partnership, and a patch was released only hours later. In the meantime, the Finnish public web services, the BBC, and other high‑profile sites have gone dark while they prepare to deploy the fix. Security experts stress the need for rapid patching, monitoring, and, where possible, temporary shutdowns to contain the threat.
Governments and cyber‑security agencies around the world are urging organisations to patch, or temporarily shut down, their websites after two serious PHP vulnerabilities were exposed by artificial‑intelligence tools. PHP, the language that powers a large share of the web through WordPress, Drupal, Joomla and countless hosting platforms, had been vulnerable to unauthenticated remote code execution for more than a decade.
The flaws were identified in late‑August when researchers from Wiz and Calif—companies participating in OpenAI’s Patch the Planet program—activated advanced AI models to analyse the language. In a frantic race, the developers released a patch on Wednesday afternoon, but the damage was already done. Links to the affected code can still be active on unpatched servers, allowing attackers to read files, inject malware or compromise databases.
The Finnish government’s public services, the BBC, Edinburgh Council, and the Dutch nation’s Cyber‑Security Agency have all taken their sites offline in a precautionary move. Other sites such as Wikipedia and the art platform DeviantArt temporarily shut down as administrators worked to determine whether their installations were running vulnerable PHP versions.
The U.S. National Security Agency, Japan’s Prime Minister, and the European Union’s CERT have all issued calls for rapid remediation, noting that the vulnerabilities provide a "direct path" to server file systems. A NCSC statement emphasizes that organisations should monitor for signs of exploitation while they patch or isolate the affected services.
Security researchers warn that PHP remains ubiquitous underground—sometimes hidden behind non‑public web panels or bundled with third‑party applications—making it a prime target for attackers once these weaknesses are exposed. The impact is likely wide, with estimates suggesting that roughly 70% of the internet could be affected if systems remain vulnerable.
In response, major cloud providers are updating mitigations and users are encouraged to switch to the latest PHP 8.2 or newer releases. Organisations are advised to audit their infrastructure, scan for PHP revisions, and apply the patch as soon as possible to prevent exploitation.
