Critical PHP Security Flaws Force Websites Offline Worldwide as Cyber Agencies Issue Warnings

Critical security flaws in PHP have prompted governments and organisations worldwide to take websites offline as fixes are issued.

What Has Triggered the Global Cybersecurity Warning?

Two critical vulnerabilities discovered in PHP, a programming language widely used to operate websites, have prompted urgent security warnings from governments and cybersecurity agencies. The PHP Foundation released fixes on Wednesday after details of the vulnerabilities appeared on social media ahead of a planned disclosure.

The flaws could potentially allow attackers to access server files or databases. The European Union Computer Emergency Response Team (CERT-EU) warned that the vulnerabilities could permit unauthenticated remote code execution, potentially enabling attackers to install malware or disrupt websites.

Cybersecurity firm Wiz estimated that roughly 70% of the internet could be affected, although that figure has not been independently verified.

FCRF’s Chief AI Officer Certification Returns on November 14 to Prepare Future AI Leaders

Which Websites Have Been Taken Offline?

Finland temporarily suspended government public web services, while several Dutch government websites became inaccessible. These included the Netherlands’ National Institute for Public Health and the Environment and the website of the Tweede Kamer, the lower house of parliament.

The Wikimedia Foundation also temporarily disabled several systems while addressing the vulnerabilities, affecting access to parts of Wikipedia.

Edinburgh council’s website and online pages associated with BBC programmes, including Doctor Who and The Traitors, were also inaccessible. However, a connection between those disruptions and the PHP vulnerabilities had not been confirmed.

How Did Artificial Intelligence Help Discover the Flaws?

Cybersecurity researchers at Calif and Wiz identified vulnerabilities that had reportedly remained undetected for more than a decade. Their work involved advanced artificial intelligence tools made available through OpenAI’s Patch the Planet programme, which included Calif and the PHP Foundation.

The researchers discovered the problems by August after several weeks of investigation. OpenAI also said one of its internal researchers had independently identified the issue around the same period. Wiz said advanced AI models helped researchers develop and adapt working exploits across multiple applications within hours, accelerating the investigation.

Why Are So Many Websites Potentially Vulnerable?

PHP supports numerous widely used website platforms, including WordPress, Drupal, Joomla and Magento. It also operates within hosting platforms, administrative systems and third-party software.

Cybersecurity experts warned that organisations may not always know where PHP is deployed within their infrastructure. CERT-EU indicated that versions dating back to PHP 5 could be affected. However, the PHP Foundation initially released updates only for the latest supported versions, leaving users of PHP 8.1 or older advised to upgrade.

What Have Cybersecurity Agencies Advised?

Britain’s National Cyber Security Centre, alongside authorities in the European Union, Australia, Japan and the United States, urged organisations to apply security updates immediately. Where immediate remediation was impossible, authorities advised temporarily disconnecting affected systems until the vulnerabilities could be addressed.

Cloudflare Chief Technology Officer Dane Knecht said early attacks were emerging as new attack methods appeared. Security experts also urged organisations to examine their systems for signs of earlier compromise.

What Should Website Operators Do Next?

Organisations using PHP face the task of identifying every affected installation, applying available fixes and checking software supplied by third parties. Security agencies have emphasised that installing updates alone may not be sufficient. Continued monitoring is necessary to identify suspicious activity and additional security guidance.

The420 Insight: The incident highlights the risks posed by vulnerabilities in widely deployed software. Website operators should identify affected PHP installations, upgrade unsupported versions and examine systems for potential compromise rather than relying solely on installing patches.