In brief
Artificial intelligence researchers uncovered two severe PHP vulnerabilities that could allow remote code execution on any site using the language. The BBC, the Finnish government, the U.K. National Cyber Security Centre and several other agencies have temporarily taken sites offline or issued urgent patch instructions. Roughly 70 % of the web is affected, including popular platforms such as WordPress, Drupal, and the BBC’s online channels. A fix was released late Wednesday, but organisations unable to patch immediately are being advised to shut down their web presence. Cybersecurity experts warn that the threat may evolve and urge continuous monitoring of all PHP‑based environments.
International governments and agencies have warned that two severe PHP vulnerabilities could let attackers gain direct access to servers and databases, and for many sites offline is the safest response.
The flaws were uncovered by AI tools used by security firms Wiz and Calif, who were part of OpenAI’s "Patch the Planet" programme. In a week the teams identified the bugs, which were finally patched in PHP’s latest release on Wednesday afternoon.
Affected sites include the Finnish Government’s public web services, the BBC’s Doctor Who and The Traitors pages, Edinburgh council’s website, and even the Windows user portal of the U.K. government. The Dutch cyber‑security agency and Japan’s Prime Minister have also called for a review of all PHP‑based services.
The U.S. National Security Agency urged organisations that could not apply the fix immediately to take their systems offline, noting that the bugs provide a "direct path to the server’s file system or database." The NCSC echoed the same advice, pointing out the widespread, sometimes hidden, use of PHP across public‑facing sites.
Experts estimate that roughly seventy percent of the internet runs on PHP–dating back to PHP 5 launched in 2004–and suggest that older releases such as PHP 8.1 remain vulnerable unless upgraded to the newest version.
Cyber‑security firms report that the AI‑driven discovery was possible thanks to large language models that can write and test code across many popular applications in hours, making the patch process “highly efficient.”
While the patch is available, the security community remains on alert: cloud‑service provider Cloudflare’s chief technology officer noted that “early attacks are emerging,” and the NCSC advises continuous monitoring of both the patch and the environment for new exploits.
If you operate a website, check whether PHP is in use and whether you are running a supported version. Apply the patch published by the PHP Foundation and consider temporary site shutdowns if updates cannot be performed immediately.
For the latest updates, readers are encouraged to monitor official channels from the NCSC, NSA, and national cyber‑security offices, and to consult the PHP Foundation’s notes for further guidance.
