Critical PHP vulnerability threatens 70% of websites prompting urgent patching and infrastructure rethink

Summary

Original publisher: Reuters

A critical flaw in the PHP programming language, which underpins more than 70% of websites, could enable attackers to take over servers and access stored data if not patched. In response, several European governments and major web operators, including the Port of Rotterdam, have taken sites offline. The Australian Signals Directorate, the US Cyber Defence Agency, and equivalents in the UK, Europe and Japan are urging urgent updates and, in some cases, temporary takedowns to guarantee safety.

• 70% plus of the web could be exposed to a chain of exploits through PHP
• Authorities urge immediate patching and possible offline web use until fixes are in place
• Researchers from Wiz discovered entry points by testing PHP code against AI models and tools
• Public patches have been published, but applying them across millions of systems will take time

Overview

A critical vulnerability in the PHP programming language has been disclosed with the potential to affect more than 70% of websites. If left unfixed, the flaw could allow attackers to seize control of compromised servers and access sensitive information. In response, several governments and major web infrastructure operators have begun taking sites offline to protect users while patches are deployed. The Australian Signals Directorate, America’s Cyber Defence Agency, and analogous bodies across the United Kingdom, Europe and Japan have urged web developers to apply urgent patches and to consider temporary takedowns when necessary to guarantee safety.

What is PHP and why it matters

PHP is a server-side programming language that has powered large portions of the web since 1997. It operates behind the scenes to manage user logins, online stores, database interactions and the generation of content for millions of sites. Its server-side nature means most users interact with PHP without directly seeing it, making vulnerabilities particularly menacing given how widely PHP is used across the internet.

The timeline of concerns

In August, cybersecurity researchers from Wiz used their own tooling and current AI models to comb through PHP’s extensive codebase in search of weaknesses that could be chained together to take over a running PHP-powered system via a crafted internet request. Within days they identified methods to break into PHP-powered systems such as Drupal and WordPress, platforms that underpin a substantial share of the web. Wiz notified the PHP security team, and by late September the developers confirmed the issue and began work on patches. A public leak on Hacker News exposed the flaws before patches were ready, prompting PHP’s developers to issue emergency patches ahead of schedule on October 21. The patching effort across millions of systems remains challenging because PHP sits beneath thousands of plugins, frameworks and managed hosting services, requiring multi-layer deployment across an intricate supply chain.

Why this keeps happening

Much of the internet relies on foundational technologies built by volunteer developers and funded through goodwill rather than robust corporate backing. These tools were created decades ago and were not designed to safely scale in a world with billions of devices and highly sensitive data. Maintenance is often not a priority for organisations, and many businesses lack full visibility into their software stacks and dependencies, making secure patching difficult and slow. This incident highlights how open-source foundations and the broader software supply chain need sustained funding and governance to reduce systemic risk.

What should you do now

Web administrators and infrastructure teams should patch as updates become available and consider temporarily taking systems offline if required to ensure safety across all layers of the supply chain. For everyday users, the primary risk is to the servers hosting sites rather than consumer devices, but it is prudent to be cautious when entering highly sensitive information on unfamiliar websites during the patching window. Major cloud providers and security firms are deploying emergency filters, and the global effort to secure the web is just beginning. Governments and businesses should treat funding for open-source, foundational tools as a critical security investment rather than charity to improve resilience against future vulnerabilities.

Implications

Beyond patching, this event underscores the need for stronger governance of digital supply chains and more robust investment in open-source infrastructure. It also raises questions about how quickly large-scale patches can be rolled out across diverse hosting environments and how users can better protect themselves during transition periods. The broader lesson is a push for credible, well-funded, and auditable security practices in foundational web technologies so the internet remains resilient as software ecosystems evolve.