What is PHP? The security flaws putting websites worldwide at risk

The flaws have raised concerns because PHP runs a large part of the internet, including websites used by governments, businesses and news organisations. PHP is a programming language that helps websites work. It runs behind the scenes, handling the work needed to build a webpage before sending it to a user's browser. It is free to use, open source and maintained by volunteers. Most website owners do not work with PHP directly, but many websites depend on it to function.

According to Web Technology Tracker W3Techs, PHP runs nearly 70% of all websites whose programming language can be identified. It is also the technology behind WordPress, the software used by around 40% of all websites. These include blogs, small business websites, government portals, online shopping platforms and news websites. This widespread use makes the security flaws particularly serious. A vulnerability in PHP can put millions of websites at risk at the same time, including sites whose owners may not even know that their servers are affected.

What are the risks of PHP security flaws? The two vulnerabilities received a severity score of 9.2 out of 10 under the CVSS v4.0 system, an industry standard used to measure the seriousness of security flaws. CERT-EU, the European Union's cybersecurity response team, said the rating indicated that the flaws could allow attackers to execute code on vulnerable servers remotely without authentication.

In simple terms, hackers could potentially send commands to an affected server over the internet without needing a password or a user account. Once an attacker exploits the flaw, they could gain control of the affected website or server. Web hosting provider GoDaddy warned that the consequences could include stolen data, altered website pages or a complete takeover of a system. Cloudflare's chief technology officer also said early attacks exploiting the vulnerabilities were beginning to emerge.

The risks are particularly concerning for smaller websites. Many are run by owners who do not have dedicated cybersecurity teams. Some also use shared hosting services, where they may have little control over server maintenance and may not know who is responsible for updating PHP. Wordfence, a security plugin used by WordPress websites, warned that the usual automatic updates would not install the fix for these vulnerabilities.

CERT-EU advised organisations to take affected websites offline if they could not apply the necessary security updates. The warning means some website operators may have to keep their sites unavailable until they can make them safe. How were the vulnerabilities discovered? The security flaws were identified by researchers using artificial intelligence (AI) models. Security firm Calif, working with OpenAI, reported the first vulnerability to PHP developers on August 11.

The company said it had discovered the flaw using OpenAI's GPT-5.6 Sol model. Wiz, a cybersecurity company owned by Google's parent company Alphabet, independently discovered the vulnerabilities. It reported a second flaw on August 24, also using AI models, Reuters reported. " The company said the underlying flaws had existed for decades. However, demonstrating that they could actually be exploited required several steps, making the process difficult even for experienced security researchers.

Wiz said proving that the flaws could be exploited involved a chain of steps that were "at the edge of what human researchers could practically achieve." What has the US government said? US President Donald Trump's administration said it was monitoring the situation and working with federal agencies and leading AI laboratories to speed up the release of the fix. The administration said it was "tracking and coordinating with federal agencies and leading SI labs to expedite the release of the fix."

SI refers to Trump's preferred term for artificial intelligence, "Super Intelligence". The administration presented the discovery as evidence that American advances in what it calls "Super Intelligence" could strengthen national security. Banks, airlines and government services affected The security warning led organisations in several countries to suspend online services while they checked their systems and applied fixes.

Japan Several major Japanese companies suspended some online services, including Nomura, Mitsubishi UFJ Financial Group, All Nippon Airways (ANA), East Japan Railway, Japan Airlines, Mizuho's banking and securities businesses, Shizuoka Bank and Seven-Eleven Japan. Government services were also affected. Japan's Ministry of Finance and Meteorological Agency partially suspended their online services, while the National Tax Agency temporarily took its service offline.

Japan's prime minister issued a public warning asking administrators to check whether their systems used PHP and install the security updates immediately. Online gaming services were also affected, particularly in Japan, where PHP-based systems are widely used. Games and services linked to Final Fantasy 14, Pokémon apps and Cygames' Umamusume were taken down for emergency maintenance. Europe Several European governments took websites offline on Wednesday as a precaution.

Telecommunications company Orange also suspended some services. Finland's Valtori, the government agency responsible for information and communications technology services, said its outages were not caused by exploitation of the vulnerabilities or a security breach. It also said it was not aware of any active exploitation. United States CISA urged organisations to install the security updates immediately.

At the time of its warning on Wednesday, the agency said it had not seen evidence that the flaws were being exploited. Australia and Singapore Australia's Signals Directorate and other government agencies issued urgent cybersecurity warnings. Singapore's Cyber Security Agency also published an advisory asking organisations to update their PHP installations immediately. China and South Korea China's industry ministry urged organisations to inspect their systems, upgrade to secure PHP versions and strengthen monitoring.

It also advised them to change accounts, passwords and security keys where necessary. South Korea raised its cybersecurity alert level for the private sector and activated emergency response measures. Germany and the Netherlands The head of the Dutch cybersecurity agency told Politico that there was no indication the vulnerabilities were being actively misused. Officials in Germany and the Netherlands have also said they had not seen evidence of successful attacks.

Are the attacks succeeding? Amazon Web Services detected attempts to exploit the PHP flaws as early as October 17, but could not confirm whether they succeeded. While Amazon's researchers say the flaws are being widely exploited, officials in several countries and the PHP Foundation have reported no confirmed successful attacks. The actual number of compromised systems remains unknown. What remains unknown?

Several important questions remain unanswered. It is not yet clear how many systems have actually been compromised, how many of the observed attempts succeeded or who is responsible for the attacks. There are also questions about whether more serious software vulnerabilities discovered with the help of AI will emerge. OpenAI said the PHP flaws were among several serious vulnerabilities it had already found.

The report also noted that this was reportedly the second time in recent months that AI-discovered flaws in web software had led to a large-scale update effort. Another concern is how long older and unsupported PHP installations will remain exposed, particularly when their owners cannot install security fixes quickly. Finally, the widely cited estimate that PHP powers around 70% of websites remains uncertain because the method used to calculate that figure has not been clearly stated.