PHP flaws force emergency patching as websites go dark

On Wednesday, developers behind PHP disclosed two critical flaws in the programming language, prompting emergency patching by security teams worldwide after government and corporate sites went offline as a precaution. The organization behind PHP and the FBI’s cyber division said the language faced significant vulnerabilities on Wednesday.

Attackers without authentication can execute code remotely on servers running PHP under certain conditions. The flaws had been present for decades, yet proving they could be exploited required an exceptionally complex chain of steps.

PHP is often called the backbone of the internet and runs on most websites. Wiz says PHP powers about 70 percent of websites worldwide, while W3Techs reports about 75 percent of sites with an identifiable programming language use PHP. WordPress runs on about 43 percent of all websites and is built on PHP, along with Drupal, Joomla, Magento and MediaWiki, which runs Wikipedia.

AI played a role in uncovering the vulnerabilities. OpenAI said it headed a coalition of researchers and security providers over the past two months, and Wiz said it identified the flaws independently using AI models including Google’s Gemini 4 Argon and GPT-5.6 Sol. Calif, a security firm, found the flaws in August as part of an OpenAI-funded audit of PHP’s code that used OpenAI’s GPT-5.6 Sol model.

Before the public announcement, Cloudflare saw thousands of exploitation attempts; the volume rose to tens of thousands afterward, then hundreds of thousands within two hours, and eventually millions. The BBC and the UK National Cyber Security Centre said they had no reports of successful attacks or breaches, though ABC Australia reported that hackers are believed to be using the flaw to compromise websites. The US National Security Agency said attackers could use the access route to steal sensitive data, disrupt services or move deeper into a network.

The disclosure led government and corporate sites in the United Kingdom, Finland, Japan, the Netherlands, France and Australia to go offline as a precaution. Authorities and businesses took sites offline to protect themselves from hacks. On Thursday, the UK government said 32 government services were down and four were partially down. Australia’s cyber.gov.au and other government sites reported outages tied to the issue.

France’s Interior Ministry briefly took local government administrative websites offline, including a Paris police site, while waiting for a fix. The Dutch cybersecurity agency took itself offline, and Finland’s state IT services provider Valtori took government public network services offline as a precaution.

Japan’s prime minister told businesses to act with great urgency, while South Korea’s government directed technology departments to update software. National governments issued urgent directives to organizations. Kombit, a Danish municipal IT company, shut down multiple services, including the national platform for school communication. A Kombit spokesperson described the shutdowns.

A garage owner in Chepstow, South Wales, said systems had been offline since Wednesday morning, stopping online MOT paperwork and certificates and causing delays based on paper processes. Dean Presley told BBC his MOT system had been down since Wednesday morning.

The US National Security Agency issued an alert telling organizations that run PHP to patch immediately or disconnect vulnerable systems. CISA, the US cybersecurity agency, did not respond to e-mails seeking comment.

Cloudflare is updating its firewall rules as a temporary measure and says customers should patch once PHP releases the update. Dane Knecht, Cloudflare’s CTO, called the firewall changes a stopgap only.

The PHP Foundation said it had known about the flaws since at least 2024 and described the delay as a structural failure. The foundation blamed its security team’s decision process and a shortage of resources. The PHP Foundation said “the delay was a structural failure, caused by both the security team’s decision process and its lack of resources.” Details of the flaws appeared online on Tuesday, a day before the planned patch release.

A PHP Foundation security engineer compared the problem to Heartbleed, the 2014 vulnerability that triggered a worldwide patching rush.

Officials cited by ABC Australia said every PHP release from version 5 onward could be vulnerable, while PHP has not identified the affected versions. Sites running PHP on their own servers face exposure, while many large platforms use other languages or could install the fix quickly.

Wiz described the flaws as among the most severe ever discovered in PHP, and possibly in all of software history. The UK National Cyber Security Centre described the event as unprecedented and said it had seen no signs of successful hacker breaches. Jason Clinton, Anthropic’s deputy chief information security officer, warned of a coming vulnerability tsunami and said critical infrastructure would not have enough time to be patched. Dane Knecht of Cloudflare said, “We are seeing early attacks emerging and are updating mitigations as new vectors show up.”

Advisories from PHP and other agencies tell users to patch right away or take sites offline if an update is not possible. The PHP website and several organizations and agencies issued advisories calling for immediate patching or shutdown. Several patches are available for different software types, and all require testing.