Critical PHP flaws force websites offline as organisations rush to patch

Websites and online services in several countries were taken offline on Wednesday after two critical vulnerabilities were disclosed in PHP, a programming language used beneath a wide range of websites and digital platforms. PHP developers issued a fix, while cybersecurity authorities urged organisations to patch immediately or temporarily disconnect systems that could not be secured. The vulnerabilities are potentially severe because they can provide attackers with a route to a server’s file system or database without requiring a password, according to the US National Security Agency.

The BBC reported that the flaws had remained undetected for more than a decade. Their disclosure prompted a global response after details leaked online on Tuesday, before the planned release of the fix. Wiz, one of the security companies involved in the discovery, estimated that PHP runs on roughly 70% of the world’s websites.

The BBC said it could not independently verify that figure. PHP is used by popular platforms including WordPress, Drupal, Joomla and Magento, as well as hosting systems, control panels and third-party products that may not make its presence obvious to the organisation operating them. The PHP Foundation, which supports developers working on the language, told users that updating was imperative.

The UK’s National Cyber Security Centre and counterpart agencies in the European Union and Australia advised organisations unable to remediate immediately to consider taking affected systems offline. The Netherlands’ cybersecurity agency issued similar advice. The precautionary shutdowns affected public services in several countries.

France took local government sites, including one belonging to Paris police, offline at the request of its national cybersecurity agency, according to the South China Morning Post. In the Netherlands, the national digital identity service DigiD, the House of Representatives website and the national cybersecurity centre’s site were among those reported inaccessible. Finland temporarily shut down the government’s public web services.

Belgium’s foreign ministry took its websites offline as a precaution, while its national cybersecurity centre said it had recorded no attacks on Belgian sites. In Australia, the government’s cyber.gov.au site was among those affected, according to the Australian Broadcasting Corporation. Parts of Wikipedia were also unavailable after the Wikimedia Foundation removed systems until they could be safely patched.

Other reported disruptions included Edinburgh council’s website and online pages for several BBC programmes. The BBC said those programme pages had not been confirmed as connected to PHP. The art platform DeviantArt described its service as temporarily down for maintenance without identifying the cause.

The flaws were found during security research using advanced AI tools. Calif discovered them in August with OpenAI’s GPT-5.6 Sol model as part of an OpenAI-funded audit. Wiz later found them independently with assistance from Google’s Gemini 4 Argon and GPT-5.6 Sol, while OpenAI said an internal researcher identified the issue around the same time.

The research formed part of OpenAI’s Patch the Planet programme, which provided Calif and the PHP Foundation with access to advanced tools. Wiz said frontier models made it practical to develop and adapt working exploits across multiple applications within hours. OpenAI described the discovery as evidence that AI can find vulnerabilities with internet-scale consequences.

The episode has also raised a defensive challenge: locating every PHP installation before attackers exploit the weakness. Sophos expert Don Smith told the BBC that PHP may run beneath public websites, content-management systems and hosting platforms without being apparent to the organisation responsible. He said organisations should also look for signs that an attacker may already have gained access.

The reports do not say that widespread exploitation has occurred.