Governments, businesses and online platforms around the world have taken websites offline as they scramble to fix serious security vulnerabilities discovered in PHP, a programming language that powers a large portion of the internet.
The two critical flaws were identified in PHP, which is used to run approximately 70 per cent of websites worldwide, according to cybersecurity firm Wiz Research. The vulnerabilities triggered urgent warnings from security authorities, with organisations advised to update their systems immediately or temporarily disconnect vulnerable websites.
The discovery has raised fresh concerns about cybersecurity as increasingly powerful artificial intelligence models demonstrate their ability to uncover weaknesses in computer systems that may have remained undetected for years.
PHP was created in the early 1990s and originally stood for “personal home page”. Its name now stands for “hypertext preprocessor”, and the language remains widely used in websites, online stores, news platforms and government services.
Wiz described the discoveries as exceptionally serious, stating in a blog post: “These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history.”
The flaws could allow attackers to execute malicious code remotely on affected servers without authorisation, potentially giving them access to sensitive information and control over website content.
Rahat Masood, a senior lecturer in cybersecurity at the University of New South Wales in Sydney, described the discovery as “quite devastating”.
She warned that attackers could potentially gain access to servers without needing a username or password.
“Once they are in the servers, they can do anything they want,” she told AFP, explaining that this could include stealing confidential information or altering website content. She urged affected organisations to treat the threat seriously.
Security Authorities Urge Immediate Updates
PHP developers released a security fix on Wednesday, prompting authorities to call on organisations to update their systems without delay.
The United States National Security Agency advised organisations to install the patch immediately or take vulnerable systems offline. Similar warnings were issued by authorities in Japan and the European Union.
A platform affiliated with China’s Ministry of Industry and Information Technology also urged organisations to act, warning of “two critical remote code execution vulnerabilities with severe impact”.
The PHP Foundation, which supports developers working on the programming language, issued a direct warning to users.
“If you run PHP, it is imperative that you update now,” the foundation said in a blog post.
Not every website was affected. The vulnerabilities primarily threatened sites running PHP on their own servers, while platforms using other programming languages or operators able to install the fix quickly were able to remain online.
Nevertheless, government websites in countries including Australia, Finland and the Netherlands were among those taken offline. Insurance companies, transport operators and media organisations also placed services under emergency maintenance.
Some popular applications were temporarily affected, including a Pokémon sleep-tracking app. The foundation responsible for Wikipedia also warned users that service interruptions could occur while it addressed the vulnerabilities.
Volker Dusch, a security engineer at the PHP Foundation, told The Wall Street Journal that the incident was the most serious problem PHP had faced in more than a decade. He compared it with Heartbleed, a major security vulnerability discovered in 2014 that triggered an international effort to secure affected systems.
AI Models Helped Discover the Vulnerabilities
The security flaws were discovered with assistance from artificial intelligence, highlighting the growing role of AI in identifying weaknesses in widely used software.
Cybersecurity firm Calif identified the vulnerabilities in August using OpenAI’s GPT-5.6 Sol model during an audit of PHP’s code funded by OpenAI.
OpenAI described the discovery as an important development in cybersecurity, saying it “marks a new phase, where AI can find security bugs with internet-scale impact.”
Wiz, which is owned by Google, independently discovered the vulnerabilities several weeks later with help from AI models, including Google’s Gemini 4 Argon and GPT-5.6 Sol.
The findings were reported privately to PHP developers, allowing them to prepare a fix before publicly disclosing the problem.
However, details of the vulnerabilities leaked online on Tuesday, one day before the planned release of the patch. The leak heightened fears that hackers could exploit the flaws before organisations had time to secure their systems.
Experts Warn of Further Cybersecurity Risks
The possibility that criminals could use AI to exploit the vulnerabilities quickly has increased pressure on organisations to respond.
Steve Kerrison, a senior lecturer in cybersecurity at James Cook University’s Singapore campus, told AFP that concerns about AI-assisted attacks had contributed to the urgency surrounding the response.
Although there was little evidence of damaging attacks at the time of the report, experts warned that stolen personal information could later be used in phishing campaigns designed to trick victims into revealing passwords or other sensitive details.
Larger organisations, including government agencies and major news outlets, were expected to have the resources to update their websites relatively quickly. However, smaller operators could face greater difficulties.
Kerrison warned that some website owners might remain unaware of the problem for an extended period.
“There are sites, systems and people out there who will have no idea about this and still won’t for days, weeks and months,” he said.
This could include privately operated blogs and smaller websites that remain unpatched. If compromised, such sites could potentially be used to distribute malware, send spam or publish malicious content.
The incident highlights both the opportunities and risks associated with AI-driven cybersecurity. While AI tools helped researchers uncover serious weaknesses and alert developers, experts are also concerned that similar capabilities could allow cybercriminals to identify and exploit vulnerabilities more quickly.
Source: AFP
