Critical programming flaws threaten millions of websites, force governments to go offline

Two critical security flaws in PHP, the programming language behind roughly 70% of the world's websites, have triggered a global cybersecurity alert, forcing government agencies and major online platforms to temporarily shut down services to prevent potential hacking attacks.

The vulnerabilities, disclosed on Wednesday, October 21, could allow attackers to remotely seize control of affected servers, steal sensitive information and compromise entire websites without requiring login credentials, according to cybersecurity firm Wiz.

The flaws carry a severity rating of 9.2 out of 10 under the international Common Vulnerability Scoring System, placing them among the most dangerous software vulnerabilities identified in recent years. 

Government websites in Finland, France and the Netherlands were temporarily taken offline as authorities scrambled to secure their systems. Australia's cybersecurity website was also affected, while Wikipedia began implementing emergency fixes.

The European Union's cybersecurity response team, CERT-EU, advised organisations unable to install security updates immediately to consider taking vulnerable websites offline.

According to Reuters, the vulnerabilities could potentially expose millions of servers to unauthorised access. 

AI discovers flaws hidden for more than a decade

Researchers at cybersecurity firms Calif and Wiz independently discovered the vulnerabilities in August using advanced artificial intelligence tools, including OpenAI's GPT-5.6 Sol and Google's Gemini 4 Argon.

The discoveries formed part of OpenAI's Patch the Planet initiative, which coordinates researchers, software developers and security providers to identify and repair critical weaknesses in widely used software.

Wiz said the underlying flaws had existed for more than a decade but were exceptionally difficult to exploit without sophisticated technical expertise.

Researchers demonstrated that the vulnerabilities could enable attackers to execute malicious code remotely on websites using WordPress, Drupal and Joomla.

The weaknesses could also expose passwords, authentication tokens and API keys stored in server memory.

PHP's development team released security patches on October 21 following weeks of coordination with OpenAI, Wiz and major technology companies, including Cloudflare, Google, Microsoft and Amazon Web Services.

Cloudflare Chief Technology Officer Dane Knecht warned that early attacks were emerging, prompting the company to update its firewall protections.

"We are seeing early attacks emerging and are updating mitigations as new vectors show up," Knecht wrote on US social media company X.

He stressed that temporary protections were insufficient and urged website operators to install the official PHP updates.

OpenAI described the vulnerabilities as among the most consequential cybersecurity issues in recent memory, warning that increasingly powerful AI systems could help both security researchers and malicious actors discover and exploit software weaknesses.

The company said its researchers appeared to have identified the vulnerabilities before attackers, giving defenders time to develop fixes. 

Why the threat extends across the internet

PHP is an open-source programming language used to operate websites, online stores, publishing platforms and government services.

It underpins major content management systems, including WordPress, which powers approximately 43% of all websites.

Unlike vulnerabilities confined to individual applications, the newly discovered weaknesses affect PHP's underlying software engine. That means even websites with otherwise secure application code could remain exposed if they use vulnerable PHP versions.

Wiz said versions dating back to PHP 5.4 were affected by at least one of the flaws.

Security agencies across Europe, Britain, Australia and Japan have urged organisations to identify vulnerable installations, apply the latest security patches and monitor their systems for suspicious activity.

Experts warned that smaller websites, particularly those operating through shared hosting services without dedicated cybersecurity teams, could face greater difficulty implementing the fixes quickly. 

--