Governments, public bodies and media groups around the world have taken websites offline after experts found two serious security flaws in PHP, a programming language that runs a large part of the internet.
A fix was released on Wednesday afternoon, and cyber-security agencies in several countries are now urging organisations to apply it quickly. Those who cannot do so in time are being told to consider shutting down their systems until the danger has passed.
Some governments have already acted. Finland has temporarily closed its public government web services, while the Dutch cyber-security agency has taken its own website offline. The National Institute for Public Health and the Environment, another Dutch government body, has done the same, and the site of the Tweede Kamer, the lower house of the Dutch parliament, can no longer be reached.
The US National Security Agency (NSA) posted a warning on X, saying the flaws "often provide a direct path to the server's file system or database." It advised organisations that cannot update straight away to take their systems offline, and promised more specific guidance soon. The UK's National Cyber Security Centre (NCSC) gave similar advice, as did its counterparts in the EU and Australia. The NCSC said that where an immediate fix is not possible, organisations should consider taking the system offline until it is fully protected. Japan's national cyber-security office and EU cyber-security officials have issued comparable warnings.
According to report by BBC, the White House said federal agencies are working with leading AI labs to speed up a solution.
The Wikimedia Foundation, which runs Wikipedia, said it had taken down a number of other systems as a precaution until they can be safely patched, so some users could not reach parts of Wikipedia on Wednesday. Edinburgh council's website also became inaccessible, as did the pages of several BBC programmes, including Doctor Who and The Traitors. None of them has confirmed a link to PHP, and the BBC has asked them for comment. The art platform DeviantArt said it was "temporarily down for maintenance" but did not give a reason.
The flaws were found by researchers at the cyber-security firms Calif and Wiz, who used advanced AI tools made by OpenAI. According to the firms, the weaknesses had gone unnoticed for more than ten years. Wiz described them as the "most severe vulnerabilities ever discovered" by AI, and said the technology helped its team build working attacks across several applications in just hours. OpenAI called the issue "one of the most impactful security issues in recent memory." Wiz estimates that "roughly 70%" of the internet is affected, although the BBC could not confirm that figure.
The scale of the problem comes from how widely PHP is used. It was built for web development and runs on servers, creating what visitors see when they open a website. Not every site relies on it, but a very large share do. Cyber-security firm Huntress said PHP "quietly powers" platforms such as WordPress, Drupal, Joomla and Magento, and also sits inside shared hosting services, control panels and many software products that never mention it.
This makes the clean-up hard. Don Smith of the Sophos Counter Threat Unit told the BBC that the biggest challenge is not installing the fix, but finding every place where PHP is running. It can be buried beneath websites, content management systems, hosting platforms and third-party products, sometimes without the organisation even knowing. He said PHP is likely to be a priority target for hackers, and urged organisations to look for signs that an attacker may already be inside their systems.
There are signs that attacks have already begun. Dane Knecht, chief technology officer at Cloudflare, said his company is seeing early attacks and is updating its defences as new methods appear. The European Union's Computer Emergency Response Team said the risk scores point to the potential for "unauthenticated remote code execution". In plain terms, an attacker could take control of a system without needing a password, then install malicious software or knock websites offline.
It is not yet clear exactly which versions of PHP are affected. The EU team said the problem could reach every version going back to PHP 5, which was released in 2004. However, the PHP Foundation has released the fix only for the latest versions, and anyone using PHP 8.1 or older is being urged to upgrade.
Once the update is installed, the NCSC advises organisations to keep watching for security updates from outside software suppliers, including for devices and services that may include PHP.