Governments, councils and major websites pulled pages offline last week after two critical vulnerabilities surfaced in PHP, the programming language that powers roughly 70% of the web. The bugs were found by AI tools, had gone undetected for more than a decade, and were serious enough that the US National Security Agency told organisations to either patch immediately or take systems offline.
The PHP Foundation rushed out its announcement after details of the flaws leaked on social media on Tuesday, ahead of the planned release later this month. Fixes shipped on Wednesday, but only for the latest versions of PHP. Anyone still running PHP 8.1 or older has to upgrade first, a heavier lift than applying a patch.
The stakes are plain. The European Union Computer Emergency Response Team said the risk scores point to unauthenticated remote code execution, meaning an attacker could install malware or take down a site without valid credentials. Finland shut down its government's public web services. The Netherlands took its national cybersecurity agency's own website offline. Edinburgh council's site went dark, along with online homes for BBC programmes including Doctor Who and The Traitors. The Wikimedia Foundation took systems offline as a precaution, and some users could not reach parts of Wikipedia on Wednesday. DeviantArt posted a generic maintenance notice without explaining why.
The scope of the disruption is worth dwelling on. CERT-EU said it could affect all versions of PHP dating back to PHP 5, which launched in 2004. The PHP Foundation has only issued updates for the latest versions, so anyone on PHP 8.1 or older must upgrade the whole runtime first. That is not a one-click patch for the many shared hosting providers and small businesses running legacy stacks. Don Smith of Sophos said the immediate challenge was not simply installing a patch but finding and managing every instance where PHP was running. The NCSC agreed, urging organisations to continuously monitor for security updates from third-party software vendors, including appliances and services that may bundle PHP.
It is not clear this will hold. Cloudflare chief technology officer Dane Knecht said he was already seeing early attacks emerging and updating mitigations as new vectors show up. The immediate problem is not the patch itself but finding every place PHP runs, since it often sits beneath WordPress, Drupal, Joomla and Magento sites, shared hosting platforms, control panels and third-party products that do not advertise it. Huntress, a cybersecurity firm, put it bluntly: PHP is everywhere, quietly powering sites and software that never mention it. The NCSC said once organisations have installed the update, they should keep monitoring for security updates from third-party vendors, including appliances and services that may bundle PHP.
How the bugs were found
The flaws were discovered by researchers at Calif and Wiz, working through OpenAI's Patch the Planet programme, which gave them access to advanced AI tools to find and fix flaws in web development languages. OpenAI said an internal researcher also found the issue around the same time, and called the discovery one of the most impactful security issues in recent memory. Wiz said frontier models were critical to making the process practical, letting teams develop and adapt working exploits across multiple applications in hours rather than weeks.
The same week brought three other headaches for security teams, none of them connected to the PHP flaws. Node.js patched four high-severity vulnerabilities in its latest release, one allowing remote code execution and two permitting a TLS validation bypass. LiteLLM, a popular open-source proxy for routing requests to multiple LLM providers, was compromised when an attacker injected malicious code and published tainted artifacts to PyPI, Docker Hub and GitHub Container Registry. An Indian certificate authority, eMudhra, had its private keys compromised, a mess security pros called bigger than Heartbleed.
The leaked timeline
While PHP Foundation intended to release its discovery later this month along with a complete fix, details of the flaw were leaked on social media on Tuesday. That forced the foundation to rush out its announcement and the huge scale of the problem. The White House said federal agencies were working with leading AI labs to speed up a fix to the issue. Japan's national cyber-security office and EU cyber-security officials issued similar warnings. The UK's National Cyber Security Centre, along with counterparts in the EU and Australia, urged those who use PHP to apply the fixes. The NSA posted on X advising organisations to take systems offline if they were unable to update. Japan's Prime Minister Sanae Takaichi urged people to check if their publicly available websites ran on PHP. The Netherlands' National Institute for Public Health and the Environment took down its website, as did the website of the Tweede Kamer, the lower house of the nation's parliament.
Why this matters beyond PHP
Cybersecurity expert Don Smith of the Sophos Counter Threat Unit told the BBC this would likely be a priority target for hackers, and that organisations should look for signs an attacker already gained a foothold. The pattern here is the part that should worry defenders. AI found these bugs in weeks after they sat dormant for over a decade, and the same tools can now help attackers build working exploits in hours. The White House said federal agencies were working with leading AI labs to speed up a fix. Japan's Prime Minister Sanae Takaichi urged people to check whether their publicly available websites ran on PHP.
What organisations should do now
The NCSC, along with counterparts in the EU and Australia, urged PHP users to apply the fixes. Where immediate remediation is not feasible, organisations should take the system offline until fully mitigated. After patching, the NCSC said organisations should continuously monitor for security updates from third-party software vendors, including appliances and services that may bundle PHP.
It is not yet clear which versions are affected, though CERT-EU said the flaws could reach back to PHP 5, which launched in 2004. The PHP Foundation has only issued updates for the latest versions, leaving older installations exposed until they upgrade.
For a deeper technical breakdown, see Reuters coverage of the incident and the BBC's full report. For related stories, see our cybersecurity coverage.
The harder question is what happens next. If AI can surface decade-old bugs in a language this widely deployed in a few weeks, the backlog of latent vulnerabilities across the software stack is almost certainly larger than anyone has mapped, and patching will not keep pace with discovery for long.