WASHINGTON, United States : Government agencies and
companies around the world shut down websites Wednesday after two critical
flaws came to light involving PHP, a programming language that is the basis for
a large share of the internet, reports BSS
PHP sits underneath popular web design platforms, so the
weaknesses potentially affect a vast range of websites, from online stores and
news outlets to government services.
Wiz, one of the security firms that found the flaws,
estimated that PHP runs about 70 percent of the world’s websites and said they
rank “among the most severe vulnerabilities discovered in PHP, and arguably in
software history.”
The US National Security Agency told organizations to
patch immediately or pull vulnerable systems offline.
Only sites that run PHP on their own servers are exposed.
Many large platforms are built on other programming
languages or use operators that could install the fix quickly and were able to
stay online.
The flaws “often provide a direct path to the server’s
file system or database,” the NSA said in a statement on X.
Attackers could use them to take over web servers without
needing a password.
Volker Dusch, a security engineer at the PHP Foundation,
told the Wall Street Journal it was the most serious problem PHP had faced in
more than a decade, comparing it to Heartbleed, a 2014 flaw that set off a
worldwide rush to patch.
The discovery came amid a surge in software security
disclosures driven by increasingly powerful AI models, with the number of
vulnerabilities found in 2026 on track to roughly double last year’s record
total.
PHP programmers released a fix on Wednesday.
“If you run PHP, it is imperative that you update now,”
the PHP Foundation, which funds developers working on the language, said in a
blog post.
Security firm Calif found the flaws in August using OpenAI’s
GPT-5.6 Sol model, as part of an OpenAI-funded audit of PHP’s code.
Wiz, which is owned by Google, said it found them
independently weeks later with help from AI models including Google’s Gemini 4
Argon and GPT-5.6 Sol.
OpenAI said on X that it considered the flaws “one of the
most impactful vulnerabilities in recent memory,” adding that the discovery “marks
a new phase, where AI can find security bugs with internet-scale impact.”
Ethan Mollick, a professor at the University of Pennsylvania’s
Wharton School who studies AI, said companies he talks to are struggling to
keep up with the pace of patches needed to guard against AI-driven
cyberattacks.
“Now consumers are going to have the same experience of
getting everything updated often and fast,” he wrote on X.
The flaws had been reported privately to PHP’s developers
and kept confidential while a fix was prepared.
Details leaked online Tuesday, a day before the planned
release of the fix, prompting the rush to take sites offline before hackers
could exploit them.
In France, local government websites, including one for
the Paris police, were made inaccessible at the request of the French National
Cybersecurity Agency, the interior ministry said.
In the Netherlands, the national digital identity service
DigiD, the website of the House of Representatives and the site of the national
cybersecurity center went offline as a precaution, according to Dutch public
broadcaster NOS.
In Australia, the Australian Signals Directorate said its
own cyber.gov.au site was among government websites affected by the flaws,
according to Australian public broadcaster ABC.
The Wikimedia Foundation, which runs Wikipedia, warned
users they could see outages on its sites while it addressed the flaws, and
said it had deliberately taken many of its supporting services offline until
they could be safely patched.
Several Pokemon apps, including Pokemon HOME, Pokemon
Champions and Pokemon Sleep, also went offline Wednesday for emergency
maintenance, with Pokemon Sleep citing security measures, according to gaming
news site Kotaku.
The operator of the hit Japanese game Umamusume said it
was carrying out maintenance to fix a PHP vulnerability found in its servers.
