Global governments and companies shut down websites on Wednesday after critical security flaws were exposed in PHP, a programming language powering a majority of the internet. Experts estimate that 70% of the world's websites run on PHP and that these vulnerabilities are among the most severe in software history. The US National Security Agency and national cybersecurity agencies in several countries called for immediate patching or offline procedures.
Context
Since PHP is widely used as the foundation for many websites, including online stores and news outlets, as well as government services, the vulnerabilities discovered posed a significant threat to a vast range of sites. Security firm Wiz estimated that PHP runs about 70% of the world's websites and said the flaws rank among the most severe vulnerabilities discovered in PHP and potentially in software history.
Significant Attention
This discovery occurred amid a surge in software security disclosures fueled by increasingly powerful AI models, with the number of vulnerabilities on track to roughly double last year's record total. For example, in August, security firm Calif discovered these flaws using OpenAI's GPT-5.6 Sol model as part of an OpenAI-funded audit of PHP's code. The flaws were reported privately to PHP's developers and kept confidential while a fix was being prepared, but details leaked online on Tuesday, prompting the rush to take sites offline before hackers could exploit them.