Global Governments Urge Emergency Action as Critical PHP Flaws Trigger Website Shutdowns Worldwide

Governments and cyber‑security agencies across the world have issued urgent warnings after two critical vulnerabilities were discovered in PHP, the programming language that powers a large portion of the internet. The flaws prompted multiple organizations to take websites offline while applying emergency fixes.

The vulnerabilities, uncovered by researchers using advanced AI tools, were described as among the most severe ever identified through automated analysis. PHP Foundation released a fix on Wednesday afternoon, but agencies warned that organizations unable to patch immediately should consider taking affected systems offline. Finland temporarily shut down its public government web services, while the Netherlands’ cyber‑security agency took its own site offline. The BBC, Edinburgh council, and several BBC program pages also became inaccessible as a precaution.

The US National Security Agency advised organizations to disconnect systems if patching was not immediately possible, noting that the flaws could provide direct access to servers’ file systems or databases. Japan’s Prime Minister urged citizens to check whether their public‑facing websites relied on PHP. The White House said federal agencies were working with leading AI labs to accelerate remediation.

The vulnerabilities were discovered by researchers at Calif and Wiz through OpenAI’s Patch the Planet initiative, which grants access to frontier AI models for vulnerability research. The flaws had gone unnoticed for more than a decade until AI‑assisted analysis surfaced them earlier this year. Wiz estimated that roughly 70% of the internet could be affected, and early attacks were already being observed by Cloudflare.

Details of the vulnerabilities leaked on social media on Tuesday, forcing PHP Foundation to rush its announcement and release partial fixes ahead of schedule. CERT‑EU warned that the flaws could enable unauthenticated remote code execution, allowing attackers to install malware or take down websites. The UK’s National Cyber Security Centre, along with agencies in the EU, Australia, and Japan, urged immediate patching or temporary shutdowns.

PHP is widely embedded across web platforms, powering WordPress, Drupal, Joomla, Magento, shared hosting environments, control panels, and countless applications that do not explicitly advertise their reliance on PHP. Security experts warned that the challenge is not only applying patches but identifying every instance where PHP is running, including hidden or bundled components.

The PHP Foundation issued updates for the latest versions, urging users of PHP 8.1 and older to upgrade. CERT‑EU said the vulnerabilities may affect all versions dating back to PHP 5, released in 2004. Organizations were advised to monitor for signs of compromise and continuously track updates from third‑party vendors that bundle PHP into their products.