What happened
Two critical vulnerabilities in the widely used web programming language PHP led on Wednesday afternoon to the release of a fix and a wave of precautionary measures by public and private organizations in several countries. The news is reported by BBC Technology, citing international cybersecurity agencies and industry companies.
The flaws were discovered using artificial intelligence by researchers at the companies Calif and Wiz, according to the source's account. Wiz called them the "most serious vulnerabilities ever discovered" by AI, while OpenAI, which launched a program called Patch the Planet in which Calif and the PHP Foundation participated, described them as one of the most impactful security issues of recent years. According to the account, the defect went undetected for more than ten years and reportedly emerged within a few weeks thanks to advanced tools.
The consequences and recommendations
Several agencies advised those unable to apply the fix immediately to consider disabling their systems. The U.S. National Security Agency wrote that such vulnerabilities often offer a direct path to a server's file system or database, while the U.K. National Cyber Security Centre recommended taking systems offline until they are fully mitigated. Similar guidance came from cybersecurity authorities in the EU, Australia and Japan.
In practical terms, Finland temporarily suspended the government's public web services, and the websites of the Dutch National Institute for Public Health and of the lower house of the Dutch parliament were not accessible. The Wikimedia Foundation, which runs Wikipedia, said it had removed some systems as a precaution while awaiting the patches, affecting access to some pages. The website of Edinburgh City Council and some online pages for BBC programs, including Doctor Who and The Traitors, also became inaccessible, but the source specifies that a link to PHP has not been confirmed for these cases. The art platform DeviantArt cited temporary maintenance without specifying the reasons.
The remaining unknowns
The scale of the problem remains to be defined precisely. Wiz estimates that about 70% of the internet is affected, but the BBC says it cannot verify this figure. CERT-EU indicated that the risk involves the possibility of unauthenticated remote code execution and that the potentially affected versions would date back to PHP 5, launched in 2004. However, the PHP Foundation released the update only for the most recent versions, urging those using PHP 8.1 or earlier to move to newer versions.
A critical element flagged by the source is timing: the PHP Foundation intended to announce the discovery later in the month along with a complete fix, but details reportedly leaked on social media on Tuesday, forcing an early announcement. Experts cited by the BBC, such as Don Smith of the Sophos Counter Threat Unit, stress that the immediate challenge is not only installing the patch but identifying every instance of PHP in use, even where it is not obvious, and checking for signs of access that has already occurred. Cloudflare reported initial attacks under way and updates to mitigations. It therefore remains to be clarified how widely the vulnerable versions are actually used, how effective the fixes are on older installations, and what impact, if any, has already been recorded.
