Governments and cybersecurity agencies worldwide have urged organisations to address two critical vulnerabilities in PHP, a programming language used by a substantial portion of the internet. Some organisations have temporarily taken their websites offline while applying security updates.
The flaws were discovered by cybersecurity researchers using advanced artificial intelligence tools. A fix was released on Wednesday, but authorities warned that organisations unable to secure their systems immediately should consider taking affected services offline.
Among the organisations affected are Finland’s government, Edinburgh City Council, the Wikimedia Foundation and several BBC programme websites. The Netherlands also took some government websites offline as a precaution.
The websites have not all confirmed that their outages are directly linked to the PHP vulnerabilities.
Governments issue urgent warnings
Cybersecurity agencies in the United States, United Kingdom, European Union, Australia and Japan have advised organisations using PHP to install the available security updates.
The US National Security Agency warned that the vulnerabilities could provide attackers with direct access to server file systems or databases. It advised organisations unable to apply the fixes to consider taking their systems offline.
The UK’s National Cyber Security Centre (NCSC) issued similar guidance, recommending that organisations temporarily disconnect affected systems if immediate remediation is not possible.
Japan’s Prime Minister, Sanae Takaichi, also urged people to check whether their publicly accessible websites use PHP.
The White House said federal agencies were working with leading AI laboratories to accelerate efforts to address the issue.
The Wikimedia Foundation, which operates Wikipedia, confirmed that it had taken some systems offline as a precaution while working to apply the necessary fixes. The move temporarily prevented some users from accessing parts of the online encyclopaedia.
Websites belonging to the Netherlands’ National Institute for Public Health and the Environment and the country’s lower parliamentary chamber, the Tweede Kamer, also became inaccessible.
Other platforms, including the art-sharing website DeviantArt, reported temporary maintenance without publicly confirming the reason.
AI helps uncover decade-old vulnerabilities
The security flaws were identified by researchers at cybersecurity companies Calif and Wiz through a programme called Patch the Planet, launched by OpenAI to help discover and fix vulnerabilities in software used to develop websites.
The programme gave participating researchers access to advanced AI tools to help identify weaknesses in web development technologies.
OpenAI said the discovery represented one of the most significant security issues in recent memory. The company also said one of its internal researchers had identified the problem around the same time as the external teams.
According to Wiz, the vulnerabilities had remained undetected for more than a decade before researchers identified them after several weeks of working with advanced AI tools.
The company said frontier AI models made it practical to develop and adapt working exploits across multiple applications within hours.
Wiz estimated that roughly 70% of the internet could be affected, although the BBC said it could not independently verify that figure.
The PHP Foundation had initially planned to announce the discovery later in the month alongside a complete security fix. However, details of the vulnerabilities reportedly leaked on social media on Tuesday, forcing the foundation to accelerate its announcement.
Why PHP is so widely used
PHP is a programming language commonly used to build and operate websites. It runs on servers to generate and deliver the content people see when visiting a website.
The technology underpins popular content management systems and online platforms, including WordPress, Drupal, Joomla and Magento. It is also used by hosting providers, control panels and third-party software, sometimes without website operators being aware of it.
Cybersecurity experts say this widespread use makes the vulnerabilities particularly concerning because organisations may struggle to identify every system that relies on PHP.
Don Smith of Sophos’ Counter Threat Unit told the BBC that the flaws would likely become a priority target for hackers.
He said organisations needed to do more than install a patch. They must also locate every instance of PHP across their infrastructure and investigate whether attackers had already compromised any systems.
Smith stressed the importance of looking for evidence that malicious actors might have gained access before the security updates were applied.
Experts warn attacks may already be emerging
The European Union’s Computer Emergency Response Team, CERT-EU, said the vulnerabilities’ risk ratings indicated the potential for unauthenticated remote code execution.
Such a weakness could allow an attacker to execute malicious code on a vulnerable server without first logging in. Depending on the system and the level of access obtained, this could enable hackers to install malware or disrupt websites.
Cloudflare chief technology officer Dane Knecht said the company was already seeing early attacks and was updating its defensive measures as new attack methods emerged.
CERT-EU said the vulnerabilities could affect PHP versions dating back to PHP 5, released in 2004. However, the PHP Foundation has issued updates for the latest versions, and users running PHP 8.1 or older have been urged to upgrade.
The NCSC also advised organisations to continue monitoring security updates from third-party software vendors, particularly for devices, applications and services that include PHP as part of their underlying technology.
The immediate priority for website operators is to identify affected systems, apply the appropriate security updates and check for signs of compromise before restoring services where they have been taken offline.
