The language that’s known as the backbone of the internet is now subject to what experts describe as one of the most notable vulnerabilities in recent memory.
PHP is a widely used general-purpose scripting language that is geared toward web development, and thus, it powers the majority of websites around the world. When the organization behind the language and the FBI’s cyber division warned Wednesday of , government agencies, corporations and other organizations were sent into a flurry.
The episode also highlights how is changing the game when it comes to web security.
Here’s what to make of the discovery of the vulnerabilities and the fallout.
The official website for PHP and several other organizations and agencies released security advisories Wednesday urging PHP users to patch two critical vulnerabilities or shut down their sites if they couldn’t update them immediately.
The PHP Foundation, which works to provide transparency and accountability with the language, said the vulnerabilities could be exploited and allow to get unauthenticated access to sites running PHP.
This would mean attackers could control a web server remotely without needing a password, said James Sullivan, director of cyber and tech at the Royal United Services Institute in London. That could allow a hacker to steal data, alter data or use the system as a platform from which to launch other attacks, he said.
PHP powers about 70% of websites globally, so the possible exposure to vulnerability was immense.
The language is free and open-source, which contributes to its prevalence online. PHP is behind the content management systems WordPress and Drupal, which are commonly used by governments for their sites, and MediaWiki, the software that runs Wikipedia.
In accordance with the security advisories issued this week, several websites were taken offline to prevent exposure while they fixed the problem. There has been disruption to some government services and websites, including in the United Kingdom, Finland and Japan.
Some websites may still be down because there are multiple patches available for different types of software, and some organizations may still be waiting to receive them. They also need to be tested to make sure they work.
Charl van der Walt, the head of security research at Orange Cyberdefense, said he believes the reaction to the vulnerabilities is just the “early tremors” of the disruption they could cause in the weeks and months ahead. He said there likely will be further service disruptions as bad actors scan the internet for vulnerable systems.
The vulnerabilities have been known about since at least 2024, according to the PHP Foundation. A security team developed several competing approaches to solutions, but each had downsides. It seemed there wasn’t a practical or concrete way attackers could exploit the vulnerabilities, so progress on a fix stalled, the foundation said.
The group took responsibility for not coming up with a fix sooner, saying: “We won’t pretend otherwise: the delay was a structural failure, caused by both the security team’s decision process and its lack of resources.”
Some experts say the discovery of the vulnerability could have been even earlier than 2024.
Although humans first discovered the vulnerabilities, artificial intelligence agents helped to identify how they could be exploited, and also supported the process of testing and validating the fixes. In a blog post, OpenAI said it had led a coalition of researchers, security providers and others to address vulnerabilities in PHP over the past two months. Researchers at Wiz, a cloud security platform, also said they independently used AI to identify the vulnerabilities.
The accessibility of AI means that many organizations big and small now have more advanced ways to proactively and reactively respond to security threats. But it also means bad actors have more advanced ways to exploit digital weak points, and at great scale and speed.
“It’s not quite as easy for defenders as it is for attackers,” van der Walt said. “You find the vulnerability in something. You replace it. But with what? Is there an alternative that is patched and robust and tested and approved?”
Sullivan, of the Royal United Services Institute in London, said while the push-and-pull can be worrisome, he’s focused on the positive side.
“We’ve actually seen quite a decent use case here where AI can discover some critical vulnerabilities and then the community can come together to remediate them,” he said.
