Critical PHP flaw forces global patches

What's happened

Security researchers have found two critical vulnerabilities in PHP, the web programming language that powers roughly 70% of sites. Fixes have been released and governments and major providers have urged immediate updates; some public websites have been taken offline while operators apply patches and test systems. Cloud services report millions of probing attempts since disclosure.

What's behind the headline?

What happened and why it matters

Researchers using large AI models have uncovered two critical vulnerabilities in PHP, a decades‑old language that runs the server side of a large portion of the web. Because the flaws allow unauthenticated remote code execution and can expose server memory, even small sites and shared hosting providers are at risk. The discovery has forced a coordinated, global patching response and precautionary service shutdowns.

The technical consequence

• Attackers can run code on vulnerable servers and read sensitive data held in memory, including credentials and database contents.
• The flaws affect PHP releases dating back years; developers have released patches but many systems will require manual updates or operator action.

The operational consequence

• Government portals, media sites and commercial services have been taken offline to apply fixes and test systems. Restoring services will take time because operators must update, verify and scan for compromise; some organisations warn this process can take days or weeks.
• Cloudflare and other infrastructure providers report an immediate surge from thousands to millions of exploitation attempts after public disclosure, increasing the risk to poorly maintained sites.

Why AI changed the equation

• AI models accelerated discovery by analysing vast codebases and finding subtle, long‑standing bugs humans missed. That same capability also compresses the window between discovery and exploitation: once technical details circulate, automated tools can weaponise them rapidly.

Forecast: what will happen next

• The race to patch will continue for weeks; high‑profile platforms with dedicated ops teams will stabilise quickly, but a long tail of unmanaged sites will remain vulnerable and will fuel ongoing attacks.
• Incident response activity will increase: operators will run memory scans, rotate keys and monitor for backdoors for months.
• Policy and investment pressure will grow for better funding of essential open‑source infrastructure and for routine automated auditing using AI and traditional tooling.

Practical takeaway

Site operators must update PHP immediately or take affected services offline until they can verify patches. Organisations should assume they will need post‑patch forensic checks, not just an update, because attackers were probing before and after disclosure.

How we got here

PHP has powered the web since the 1990s and underpins platforms such as WordPress and Drupal. Researchers using advanced AI models have uncovered two long‑hidden flaws that allow unauthenticated remote code execution; the PHP Foundation has issued emergency patches and agencies including the US NSA and national CERTs have ordered urgent mitigation.

Our analysis

The reporting converges on a single narrative: AI‑assisted audits found two severe PHP flaws and the industry is racing to patch. OpenAI framed the event as unusually consequential: the company called the discovery "one of the most impactful security issues in recent memory" (New York Times; OpenAI blog referenced by AP News). France 24 and BBC emphasised scale, noting PHP runs roughly 70% of identifiable websites and quoting security specialists who warned of a long tail of vulnerable sites. Cloudflare quantified the surge: "in the 10 hours before it was publicly announced...thousands of attempts," rising to "millions now," Matthew Prince said (Arab News; France 24 quoting Cloudflare). On origins and coordination, Al Jazeera and France 24 report that two firms — Calif (working with OpenAI) and Wiz — independently found the flaws using AI models and coordinated disclosure with PHP's developers before a leak forced earlier public fixes. The Guardian and BBC highlight national responses: US and UK cyber agencies urged immediate mitigation and some governments temporarily took public sites offline. Japan's broad precautionary shutdowns and industry advisories in China were described in Arab News and France 24, illustrating how national authorities have moved from guidance to enforced action. These sources differ mainly in emphasis: The New York Times and OpenAI narratives stress the role of frontier AI in discovery and coordination; France 24, BBC and The Guardian stress operational disruption and the long tail risk to smaller, poorly maintained sites. Cloud services coverage (Cloudflare, quoted across outlets) supplies concrete attack metrics that underline urgency.

Go deeper

• Which PHP versions are vulnerable and how do I check my server?
• How long will it take for hosted platforms like WordPress to push fixes to users?
• What forensic steps should organisations take after patching to check for compromise?

More on these topics

• Cloudflare - Internet company

  Cloudflare, Inc. is an American web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.

• OpenAI - Artificial intelligence company

  OpenAI is an artificial intelligence research laboratory consisting of the for-profit corporation OpenAI LP and its parent company, the non-profit OpenAI Inc.

• PHP - Programming language

  PHP is a general-purpose scripting language geared towards web development. It was created by Danish-Canadian programmer Rasmus Lerdorf in 1993 and released in 1995. The PHP reference implementation is now produced by the PHP Group.

• WordPress - Application programming interface

  WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system, referred to within WordPress as Themes.

• United Kingdom - Country in Europe

  The United Kingdom of Great Britain and Northern Ireland, commonly known as the United Kingdom or Britain, is a sovereign country located off the north­western coast of the European mainland.

• National Security Agency - Intelligence agency

  The National Security Agency is a national-level intelligence agency of the United States Department of Defense, under the authority of the Director of National Intelligence.

• Finland - Country in Europe

  Finland, officially the Republic of Finland, is a Nordic country in Northern Europe. It shares land borders with Sweden to the west, Russia to the east, Norway to the north, and is defined by the Gulf of Bothnia to the west, and the Gulf of Finland of the

• France - Country in Europe

  France, officially the French Republic, is a country consisting of metropolitan France in Western Europe and several overseas regions and territories.

• Netherlands - Country in Europe

  The Netherlands, informally Holland, is a country primarily located in Western Europe and partly in the Caribbean, forming the largest constituent country of the Kingdom of the Netherlands.

• Google - Technology company

  Google LLC is an American multinational technology company that specializes in Internet-related services and products, which include online advertising technologies, a search engine, cloud computing, software, and hardware.

• Wikipedia - Website

  Wikipedia is a multilingual online encyclopedia created and maintained as an open collaboration project by a community of volunteer editors using a wiki-based editing system. It is the largest and most popular general reference work on the World Wide Web.

• South Korea - Country in East Asia

  South Korea, officially the Republic of Korea, is a country in East Asia, constituting the southern part of the Korean Peninsula and sharing a land border with North Korea.

• National Cyber Security Centre - Wikimedia disambiguation page

  National Cyber Security Centre, National Cyber Security Center, or National Cybersecurity Center may refer to:

• Wikimedia Foundation - Non-profit

  The Wikimedia Foundation, Inc. is an American non-profit and charitable organization headquartered in San Francisco, California. The WMF owns and operates Wikipedia as well as other Wikimedia projects. The content on these projects is written by volunteer

• Japan - Country in East Asia

  Japan is an island country of East Asia in the northwest Pacific Ocean. It borders the Sea of Japan to the west and extends from the Sea of Okhotsk in the north to the East China Sea and Taiwan in the south.

• City of Edinburgh Council - Scottish unitary authority council in Edinburgh, Scotland, UK

  The City of Edinburgh Council is the local government authority for the City of Edinburgh. It was created in 1996 under the Local Government etc. Act 1994, with the boundaries of the post-1975 City of Edinburgh District Council of the Lothian region.

• Australia - Country in Oceania

  Australia, officially known as the Commonwealth of Australia, is a sovereign country comprising the mainland of the Australian continent, the island of Tasmania, and numerous smaller islands.

• European Union

  The European Union is a political and economic union of 27 member states that are located primarily in Europe. Its members have a combined area of 4,233,255.3 km² and an estimated total population of about 447 million.

• Federal Bureau of Investigation - Law enforcement agency

  The Federal Bureau of Investigation is the domestic intelligence and security service of the United States and its principal federal law enforcement agency.

• Kingdom of Saudi Arabia - Country in the Middle East

  Saudi Arabia, officially the Kingdom of Saudi Arabia, is a country in Western Asia constituting the bulk of the Arabian Peninsula.

• Paris - Capital of France

  Paris is the capital and most populous city of France, with an estimated population of 2,150,271 residents as of 2020, in an area of 105 square kilometres.

• Edinburgh - Capital of Scotland

  Edinburgh is the capital of Scotland and one of its 32 council areas. Historically part of the county of Midlothian, it is located in Lothian on the Firth of Forth's southern shore.

• Sanae Takaichi - Japanese Politician

  Sanae Takaichi is a conservative Japanese politician.

• Python - High-level programming language

  Python is an interpreted, high-level, general-purpose programming language. Created by Guido van Rossum and first released in 1991, Python's design philosophy emphasizes code readability with its notable use of significant whitespace.

• Singapore - Country in Asia

  Singapore, officially the Republic of Singapore, is a sovereign island city-state in maritime Southeast Asia. It lies about one degree of latitude north of the equator, off the southern tip of the Malay Peninsula, bordering the Straits of Malacca to the w

• Wiz - IT security company

  Wiz is a cloud security startup headquartered in New York City. The company was founded in January 2020 by Assaf Rappaport, Yinon Costica, Roy Reznik, and Ami Luttwak, all of whom previously founded Adallom.

• Wiz - Wikimedia disambiguation page

  Wiz may refer to:

• The United States of America - Country in North America

  The United States of America, commonly known as the United States or America, is a country mostly located in central North America, between Canada and Mexico.

• Joomla - System software

  Joomla, also spelled Joomla! and sometimes abbreviated as J!, is a free and open-source content management system for publishing web content on websites.

• University of New South Wales - Public research university Kensington, Sydney, Australia

  The University of New South Wales (UNSW; branded as UNSW Sydney since 2017) is an Australian public research university located in the Sydney suburb of Kensington. In 2012, UNSW recorded the highest median ATAR of any university in NSW and attracted the..

• Matthew Prince - CEO of CloudFlare

  Matthew Browning Prince is an American billionaire businessman and executive. He is the co-founder, executive chairman, and chief executive officer of the technology company Cloudflare.