Critical PHP Flaws Put Over 70 Percent of Websites at Risk as Government Sites Go Offline
Two severe security flaws have been found in PHP, the programming language on which a large share of the world's websites stand. Experts warn that a hacker exploiting the flaws could alter a website or extract data from its database, including personal information.
After the news broke, government websites in Europe and elsewhere went offline one after another, or were taken down as a precaution. Website operators scrambled to protect their systems, while PHP's developers released urgent fixes on Wednesday and urged all users to update immediately.
PHP runs on the servers that host websites, building pages behind the scenes before they reach a visitor's browser. Most people never see it, yet everything from blogs to online shops and government portals runs on it.
Most worrying of all, the flaws had been lurking inside the software for years and were uncovered with the help of artificial intelligence. But details of the flaws leaked online on Tuesday, before the fixes were ready, forcing the PHP team to rush the patches out.
Experts say they are bracing for a wave of intrusions as hackers race to exploit the flaws ahead of the updates. Andrew Cullen, a lecturer on AI and cybersecurity at the University of Melbourne, noted that many devices in the world are connected to a single piece of foundational software — and that is where the bug was found.
According to Cullen, the vulnerability lets a hacker run code on a website, meaning they could change the website or force it to release personal information held in a database. The cloud security company Wiz said both flaws stem from how PHP handles fatal errors, such as running out of memory; because the problem sits in PHP itself, even the simplest website running an affected version can be vulnerable, and attackers could read passwords and other credentials from a server's memory.
Both flaws scored 9.2 out of 10 on the industry's standard severity scale, placing them in the 'critical' category. The two flaws, nicknamed PHP2Shell, were found independently by two cybersecurity companies using AI. Calif, working with OpenAI, reported the first on August 11, while Wiz, which is owned by Google, reported the second on August 24.
Wiz said in a statement that the vulnerabilities had remained hidden in the PHP codebase for more than a decade and would have been extraordinarily complicated for a human hacker to take advantage of. Calif and Wiz said they had coordinated with each other, the PHP team and OpenAI before making the flaws public.
However, Amazon security chief CJ Moses said his team detected an attempt to exploit the vulnerabilities on October 17, four days before the public disclosure. It was unclear how the hacker learned of the flaws while the reports from Calif and Wiz were still under embargo; security researchers usually keep details of flaws secret until a fix is ready, so attackers cannot use them in the meantime.
The language dates back to the early 1990s and initially stood for Personal Home Page. It is baked into WordPress, Drupal, Joomla and Magento sites, meaning any critical vulnerability potentially has enormous knock-on consequences. Calif, Wiz and the web infrastructure company Cloudflare said the flaws affect PHP 5.4 and later versions — more than a decade of releases.
Cullen called the vulnerability 'really unprecedented', noting that PHP powers more than 70 percent of websites globally, although sites that have been updated are protected. 'There is a real risk to the kind of shared digital infrastructure that we all rely on,' he said, adding that there is concern in the cybersecurity community about the blast radius even though PHP's developers moved very quickly to develop patches.
Cullen also highlighted AI's double-edged role: it is getting better at cybersecurity, but also better at hacking. In his words, systems are being developed that make the internet safer by helping to fix bugs, but also riskier by discovering and creating bugs that can be hacked.
In the Netherlands, the Dutch cybersecurity agency itself went offline as a precaution. The Port of Rotterdam, the government portal Overheid.nl, the national football association KNVB, the websites of the country's five largest political parties and several hospital websites followed the same example. Dutch Prime Minister Rob Jetten said he was closely monitoring the situation.
In Finland, state IT services provider Valtori said government public network services had been taken offline 'as a precautionary measure'. France's Ministry of the Interior placed all of its websites into preventive maintenance. Belgium's Federal Public Service for Foreign Affairs, Foreign Trade and Development Cooperation temporarily took its websites offline after reports of cyberattacks exploiting the PHP flaws, although the country's cybersecurity centre said it had not recorded any attacks on Belgian websites.
South Korea's government raised its private-sector cybersecurity alert level and activated emergency response measures, issuing security guidance to about 28,000 companies with registered chief information security officers, 5,900 members of a government information-sharing network, and operators of critical infrastructure, web-hosting firms and data centres. The operator of Wikipedia also said it had taken down an unspecified number of systems until they could be safely patched, while the Internet Archive, the sprawling online library, also briefly went offline to deal with the issue.
All told, the fight is now a race against time: the faster website operators can install the patches, the smaller the hackers' window of opportunity. Every unpatched site remains a potential target for now, and experts believe more intrusion reports may emerge in the coming days.
