Critical Flaws in PHP Language Prompts Global Precautionary Website Shutdowns

A pair of critical, decade-old security vulnerabilities discovered in the PHP programming language, which powers approximately 70% of all websites globally, has prompted emergency warnings and precautionary web shutdowns across international governments, public services, and major corporations.

The vulnerabilities allow unauthenticated remote code execution, giving malicious actors a direct path into server databases or file systems without needing login credentials. Cyber-security agencies in the US, UK, Europe, Australia, and Asia issued urgent directives recommending that organizations unable to immediately apply security patches take their public systems offline to prevent exploitation.

The flaws were identified by AI tools as part of research programs involving cybersecurity firms Calif and Wiz, in collaboration with OpenAI's "Patch the Planet" initiative. According to Wiz, researchers utilized advanced artificial intelligence models including Google's Gemini 4 Argon, OpenAI's GPT-5.6 Sol, and Wiz Atlas to uncover vulnerabilities that had remained undetected in the PHP codebase for over ten years.

While the PHP Foundation planned a coordinated disclosure later this month alongside a complete security patch, details regarding the vulnerability leaked onto social media on Tuesday. The leak forced maintainers to accelerate the public announcement and release urgent security updates.

Governments and institutions worldwide responded by taking vulnerable infrastructure offline to insulate systems from attack:

• Government and Legal Portals: The Dutch government temporarily suspended public access to its national digital identity service, the lower house of parliament (Tweede Kamer), and its national cybersecurity center. Precautionary shutdowns were also executed across municipal and public portals in France, Germany, Belgium, and the UK, including local council websites in Edinburgh, Bristol, and Oxford.
• Asian Enterprise Precautions: Japan's Prime Minister Sanae Takaichi urged domestic entities to inspect public systems and suspend services if patching was delayed. Subsequently, major entities including All Nippon Airways (ANA), Mitsubishi UFJ Financial Group, Asahi Group, Sega, Bandai Namco, and Keihan Holdings instituted temporary maintenance or partial suspensions on non-core web systems. South Korea raised its private-sector cyber-crisis alert level following emergency inter-agency meetings.
• Digital Platforms: The Wikimedia Foundation took down multiple supporting services, leading to intermittent access issues across parts of Wikipedia. The BBC also saw specific program pages become temporarily unavailable.

Cyber-security experts warn that the public release of the patch enables threat actors to use AI tools to reverse-engineer the bug and automate exploits across vulnerable web servers.

Cloudflare reported detecting "millions" of exploitation attempts following public disclosure, while Amazon's security team identified unauthorized probing against its decoy honeypot systems four days prior to the official release.

The UK National Cyber Security Centre (NCSC) and the US National Security Agency advised network administrators to verify whether systems have been compromised prior to patching, emphasizing that legacy applications running PHP 8.1 or earlier require immediate upgrades or alternative mitigations.

Security maintainers stressed that because PHP sits behind widespread content management systems like WordPress, Drupal, and Magento, identifying every active instance across complex corporate environments represents an immediate operational challenge.