Two critical flaws in the PHP programming language, found by AI, led governments and organizations worldwide to pull websites offline while they apply a fix.

 

What happened

Researchers discovered two critical vulnerabilities in PHP, the language that powers much of the internet, and the PHP Foundation issued a fix on October 21, 2026. Cybersecurity agencies urged organizations that could not patch in time to consider taking their sites down. Finland temporarily shut down its government’s public web services, and the Netherlands’ cyber-security agency took its own website offline. The Dutch National Institute for Public Health and the Environment also removed its site, and the Tweede Kamer’s website became inaccessible. The Wikimedia Foundation took down several systems, which left some people unable to reach parts of Wikipedia. Edinburgh council’s website and several BBC program sites, including Doctor Who and The Traitors, also went dark.

 

The backstory

The flaws went undetected for more than a decade. Cybersecurity firms Calif and Wiz found them after a few weeks of using advanced AI tools in August. Calif and the PHP Foundation took part in OpenAI’s Patch the Planet program, which gave them access to the company’s AI tools to find and fix flaws in web development languages. An OpenAI researcher also found the issue around the same time. The PHP Foundation planned to release its discovery and a complete fix later this month, but details leaked on social media on Tuesday. The leak forced the foundation to rush out its announcement.

 

Going deeper

According to the BBC:

  • The EU’s CERT-EU said the vulnerabilities’ risk scores indicate the potential for unauthenticated remote code execution. Attackers could use this to install malware and take websites down.
  • CERT-EU said the flaws could affect all versions back to PHP 5, which launched in 2004. However, it is not yet clear which versions are affected.
  • The PHP Foundation issued the update only for the latest versions. It urged people running PHP 8.1 or older to upgrade.
  • The UK’s National Cyber Security Centre, along with its EU and Australian counterparts, urged PHP users to apply the fixes. Japan’s national cyber-security office and EU officials issued similar warnings.
  • The White House said federal agencies are working with leading AI labs to speed up a fix.
  • Japan’s Prime Minister Sanae Takaichi urged people to check whether their public websites run on PHP.
  • The NCSC advised organizations to monitor continuously for security updates from third-party vendors, including appliances and services that may bundle PHP.

What was said

The US National Security Agency told organizations on X to take systems offline if they could not update. It warned that “These vulnerabilities often provide a direct path to the server’s file system or database.”

OpenAI described the discovery as “one of the most impactful security issues in recent memory.”

The NCSC told organizations that cannot remediate immediately to “consider taking the system offline.”

Sophos Counter Threat Unit expert Don Smith told the BBC the flaw would “likely be a priority target” for hackers.

 

By the numbers

  • Wiz estimates “roughly 70%” of the internet is affected.
  • The flaws went undetected for more than a decade.
  • Researchers found them after a few weeks of using advanced AI tools.
  • CERT-EU says the flaws may affect all versions back to PHP 5, which launched in 2004.
  • The PHP Foundation issued the fix only for the latest versions and urged users of PHP 8.1 or older to upgrade.

In the know

Developers created PHP for web development, and servers use it to build what visitors see on a website. Not every site uses it, but it powers a large portion of the internet. PHP runs WordPress, Drupal, Joomla, and Magento sites, shared hosting platforms, and control panels. It also runs a lot of software that does not advertise its use of PHP.

 

Why it matters

This incident shows how hard it is to patch software that hides inside other software. Don Smith said the immediate challenge is not simply installing a patch. Organizations must first find and manage every instance of PHP, which can sit beneath public websites, content management systems, hosting platforms, and third-party products, sometimes without the organization knowing. That is why agencies told organizations to monitor vendors for updates, including appliances and services that bundle PHP.

The case also shows what AI can do for defenders and attackers. AI tools surfaced flaws that humans missed for more than a decade, and Wiz said they let researchers develop working exploits across multiple applications in hours.

 

The bottom line

Organizations should find every place PHP runs in their systems, including inside third-party products, and apply the PHP Foundation’s update now. Anyone on PHP 8.1 or older must upgrade. Those who cannot patch immediately should consider taking affected systems offline, as the NCSC and NSA advise, and they should check for signs of compromise.

Related: HIPAA Compliant Email: The Definitive Guide

 

FAQs

What is PHP?

PHP is a popular open-source scripting language that runs on web servers to generate the pages people see in their browsers.

 

What is remote code execution?

Remote code execution is a type of attack that lets someone run their own commands on a system from afar, often giving them control over it.

 

What does ‘unauthenticated’ mean in this context?

It means an attacker could exploit the flaw without logging in or having any valid credentials.

 

How can an organization find out whether it uses PHP?

Organizations can inventory their websites, servers, hosting platforms, and third-party software, and ask vendors whether their products include PHP.