When the Finnish government pulls its public web services offline and the NSA tells organisations to switch off systems they can’t patch, this is not routine Patch Tuesday noise. Two critical flaws in PHP, the language behind a huge chunk of the web, have set off a scramble that is still running.
The vulnerabilities sat undetected for more than a decade. A fix was issued Wednesday, and as the BBC reported, agencies in the UK, EU, Australia and Japan urged anyone who can’t apply it quickly to consider taking sites down. The Netherlands’ cyber agency pulled its own site. Wikimedia took some systems offline as a precaution.
Why PHP makes this so ugly
PHP quietly runs WordPress, Drupal, Joomla and Magento, plus shared hosting platforms and control panels. Huntress notes plenty of software uses it without advertising the fact. That is the real problem. Sophos’ Don Smith says the hard part isn’t installing a patch but finding every place PHP is running, including inside third-party products.
CERT-EU says the risk scores point to unauthenticated remote code execution. In plain terms, an attacker needs no login to run code on your server. The NSA says such flaws often give a direct path to the file system or database. For users, that means stored account details and personal data on affected sites are potentially exposed. Cloudflare’s CTO says early attacks are already emerging.
AI found it, and the leak made it worse
Researchers at Calif and Wiz found the bugs using advanced AI tools via OpenAI’s Patch the Planet program. Wiz says frontier models let them build working exploits across multiple applications in hours. Read that again. The same speed that helps defenders finds and weaponises flaws for attackers too.
Then came the leak. PHP Foundation planned to publish details later this month with a full patch, but the flaw surfaced on social media Tuesday and forced a rushed announcement. Coordinated disclosure only works when it stays coordinated.
Treat the big numbers carefully
Wiz estimates roughly 70% of the internet is affected. The BBC could not verify that, and it deserves skepticism coming from a vendor with a stake in the story. Still, even a fraction of that is enormous.
The patch gap matters more. CERT-EU says all versions back to PHP 5, released in 2004, may be affected. But PHP Foundation has only issued updates for the latest versions, and anyone on PHP 8.1 or older is told to upgrade. Plenty of neglected sites and old hosting setups will not.
What to do
If you run a site, check for PHP everywhere, including bundled appliances, then patch and look for signs an attacker already got in. If you’re a user, expect outages, and be wary of any service that stays vague about why it’s down. DeviantArt only said it was down for maintenance. Silence is not reassurance when your data may be on those servers.