Critical security vulnerabilities identified in the widely used PHP programming language have prompted an international scramble to secure web infrastructure. On Wednesday, the PHP Foundation released an emergency patch for the flaws, which cyber-security firm Wiz described as the most severe vulnerabilities ever discovered with the assistance of artificial intelligence. These security gaps, which had remained hidden for over a decade, were uncovered by researchers at Calif and Wiz using advanced AI tools under the OpenAI-backed Patch the Planet program.
The impact of the discovery is extensive, with estimates suggesting that roughly 70% of the internet could be affected, though this figure remains unverified.
The vulnerabilities, which could potentially date back to PHP 5 launched in 2004, allow for unauthenticated remote code execution.
This risk enables attackers to gain a direct path to server databases and file systems, potentially facilitating malware installation or total site control. The European Union Computer Emergency Response Team (CERT-EU) underscored the severity of these risk scores, while Cloudflare’s chief technology officer, Dane Knecht, reported observing early-stage attacks as hackers attempt to exploit the gaps.
Governments and public bodies have reacted swiftly. Finland has temporarily disabled its public web services, and the Netherlands has taken its own governmental and parliamentary websites, including those for the National Institute for Public Health and the Environment and the Tweede Kamer, offline. In the United States, the White House is coordinating with AI labs to accelerate solutions, and the National Security Agency has advised organizations to pull systems offline if they cannot immediately apply the patch. Leaving bodies such as the Finnish government, Edinburgh council and to take pages offline, multiple cyber-security agencies have urged organisations unable to apply fixes in time to consider taking their sites down. According to meanwhile, the White House, Federal agencies were working with leading AI labs to speed up a fix to the issue. The lower house of the nation’s parliament, has become inaccessible, similarly the website of the Tweede Kamer. According to where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated,” the NCSC, In a note, external. It is used on servers to implement what you see when you visit websites. But it nonetheless powers a large portion of the internet, not all websites use it.
Other entities are also managing outages as a precaution. The Wikimedia Foundation confirmed it is addressing the issue, which resulted in intermittent access problems for parts of Wikipedia. Various other sites, including Edinburgh council and specific pages for programmes like Doctor Who and The Traitors, have experienced downtime, although specific links to the PHP vulnerability are pending official confirmation from those providers. Art platform DeviantArt also reported temporary maintenance, a common strategy currently being employed to mitigate risk. They have not confirmed a link to PHP – has approached them for comment. It added an internal researcher at the company had also discovered the issue around the same time as the other firms.
Japanese Prime Minister Sanae Takaichi issued an urgent public appeal via social media, advising administrators to audit their infrastructure for PHP usage. This warning is echoed by global experts who highlight that PHP often operates invisibly behind content management systems like WordPress, Joomla, Drupal, and Magento, or within third-party appliances, making it difficult for organizations to track every instance of the language running on their networks. It âquietly powers WordPress, Drupal, Joomla, and Magento sites, shared hosting platforms, control panels, and an awful â lot of software that doesn’t even advertise that it runs PHP under the hood,” cyber-security company Huntress said.
Expert Don Smith of the Sophos Counter Threat Unit warned that the situation is a high-priority target for malicious actors.
He urged organizations to look for signs of a pre-existing foothold, as simply applying a patch is only one part of the security response. According to he, It was crucial that organisations looked out for signs that an attacker “might have already have gained a foothold”.
The PHP Foundation has currently issued updates only for newer versions, specifically targeting PHP 8.1 and later, leaving users on older, unsupported versions at increased risk.
The UK’s National Cyber Security Centre (NCSC) advised that once the current patch is applied, organizations must maintain rigorous monitoring for secondary security updates from any third-party vendors that may have bundled PHP within their software.
The scale of the crisis was compounded by a premature leak of the vulnerability details on social media, which forced the PHP Foundation to fast-track its disclosure and release schedule. OpenAI noted that the discovery process, which took mere weeks of utilizing frontier models, represents a significant shift in the cyber-security landscape, demonstrating how AI can be leveraged to identify massive systemic risks that have long gone unnoticed. According to openAI, In a blog post, external that the discovery was “one of the most impactful security issues in recent memory”.
