The decision to take public websites offline was a calculation about risk: for agencies running PHP, a temporary loss of access could be safer than leaving systems exposed while patches were applied. PHP is used by almost 70% of websites, giving a defect in the language an unusually wide path into public services and other online infrastructure.
Researchers at cybersecurity firms Calif and Wiz found two critical vulnerabilities in PHP on 1 August using AI tools. Calif said it had identified the flaws with help from a large language model.
The vulnerabilities had been present for roughly 20 years. Wiz said exploiting them “required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve”.
That difficulty did not remove the danger. CJ Moses, Amazon’s security chief, said the company detected an attempt against one of its decoy “honeypot” systems on 17 October, four days before the vulnerabilities became public.
The White House said it was made aware of the flaw on Friday. On Tuesday, the vulnerability became public.
The PHP Group said the two flaws could enable “unauthenticated remote code execution”, allowing an attacker to run code without first being authenticated. Wiz called them “among the most severe vulnerabilities discovered … in software history”.
On Wednesday, national authorities and public bodies moved to contain the risk. The US National Security Agency told all organisations using PHP to take systems offline if they could not patch immediately. The UK’s National Cyber Security Centre issued similar advice and told organisations to look for “backdoors installed by an attacker”.
Governments in Belgium, the Netherlands, Finland, France, Germany, Denmark and the UK took websites offline as a precautionary measure. Belgian, Dutch, Finnish, French and German government sites were among those temporarily taken down after the serious PHP vulnerability was found.
In the Netherlands, the national digital identity service, the website of the house of representatives and the site of the national cybersecurity centre went offline.
French local government sites, including the Paris police prefecture’s website, went offline on Wednesday. In the UK, websites belonging to Edinburgh, Bristol and Oxford councils were also taken offline.
The response extended beyond government. The Wikimedia Foundation took down several systems on Wednesday, and the University of Geneva also took down its systems as a precaution.
On Wednesday, the PHP Foundation rolled out patches to address the two critical vulnerabilities. Organisations around the world then worked to apply them and restore systems.
Evan Solomon, Canada’s Minister of Artificial Intelligence and Digital Innovation, posted on X about the decision to temporarily take government websites offline.
In Japan, Prime Minister Sanae Takaichi urged people to check whether their publicly available websites ran on PHP. “We have an urgent request for everyone to take action tonight,” she wrote on X, adding: “If it is difficult to apply the fix patch promptly, temporarily suspending websites and similar measures can be considered an effective way to reduce risk”.
Tiffany Farriss, interim chief executive of the Drupal Association, said: “All servers using any version of PHP released in the last 20 years will be vulnerable” and “This issue impacts the majority of the Internet”.
Paul Spain, chief executive of Gorilla Cyber Security, estimated that the flaw could affect “millions and millions” of websites.
The central concern is the speed at which a publicly disclosed weakness can be turned into an attack. Costin Raiu, co-founder of cybersecurity research and incident response firm TLP:Black, said AI was powering a “race to exploit”.
Amazon detected an attempted exploit against a decoy system before disclosure, but the available information does not establish whether government systems were breached or how many websites were exploited after the patches were released.
Comments (0)