A Hole in PHP’s Foundations

Millions of websites are being checked, patched or temporarily taken offline after two severe security flaws were disclosed in PHP, one of the programming languages most commonly used to run the web.

The scale matters because PHP is not some obscure layer tucked away in a back room. According to W3Techs, as cited by The Independent, it powers nearly 70 per cent of identifiable websites and underpins WordPress, which itself runs a large share of the internet’s blogs, shops, government pages and news sites. When something that common breaks, the problem does not stay neatly inside engineering teams.

CERT-EU, the European Union’s cyber response team, said the bugs amount to unauthenticated remote code execution. In plainer language, that means an attacker could run commands on a vulnerable server over the internet without needing a password or account. GoDaddy said that kind of access can lead to stolen data, defaced pages or full-system compromise.

The Independent reported that a UK minister said 32 government services were offline and four were partially unavailable because of the flaw, while Downing Street said major public-facing critical services had not been affected. It also reported that multiple European government websites were taken down while administrators worked on fixes.

The speed of attempted exploitation is part of what makes this feel less like a routine patch cycle and more like a scramble. Cloudflare chief executive Matthew Prince said the company saw attempts rise from thousands before public disclosure to millions after details spread. The same report said Cloudflare’s chief technology officer had warned that early attacks were already emerging.

There is also an unnerving symmetry to how this surfaced. Researchers at Calif, working with OpenAI, reported one flaw after finding it with an AI model, according to The Independent. Wiz, the Google-owned security firm, independently found vulnerabilities and reported another. The article said the underlying flaws had been present for decades, but that proving they were exploitable required a chain of steps at the edge of what human researchers could practically achieve. That is the kind of sentence that lands differently once millions of attack attempts are already being counted.

For smaller site owners, this is also the sort of problem that arrives without much control or visibility. The Independent reported that many small websites run on shared hosting, often by owners with no security staff and little direct involvement in how PHP is updated. Wordfence warned that the usual automatic updates would not apply this fix, and CERT-EU’s guidance was to take affected sites offline rather than leave them exposed.