It is used by nearly 70% of websites: two massive vulnerabilities linked to the PHP programming language threaten a large part of the web

The two flaws are described as major PHP-related cybersecurity vulnerabilities. However, the supplied article text does not give their names, CVE numbers, or technical details. That means their exact nature cannot be identified from this source alone. Their importance comes from PHP’s broad use across the web.

When a serious flaw is discovered in software used by websites, attackers may try to exploit unpatched systems. Operators can temporarily restrict access while they install fixes, check systems, and reduce the chance of compromise. This explains why many sites suddenly displayed maintenance messages.

The source reports emergency maintenance at websites around the world and links the disruption to two PHP flaws. It does not report a confirmed attack or explain whether data was stolen. The immediate response was defensive: limit exposure, apply available security updates, test services, and restore access when operators judge systems safe.

The source points to a broad range of online services rather than one narrow industry. It mentions BFM, prefectures, media outlets, and tax services. These examples show that the issue could affect public information, government-related services, news publishing, and administrative tasks. The headlines also refer to websites worldwide.

A website in any of these sectors may depend on PHP somewhere in its technical stack. If that software has a serious vulnerability, operators may take the service offline or display a maintenance notice. The key mechanism is precaution: reducing public access while the underlying PHP installation and connected systems are checked or updated.

The source describes many sites as inaccessible or placed in maintenance on Wednesday afternoon. It does not provide a complete list, a precise count, or separate figures for each sector. It also mentions Orange in a headline, but does not establish that every outage had the same technical cause. The common concern was exposure to the PHP flaws.

The source says PHP is used by nearly 70% of websites. It does not provide a total number of websites, so no exact count can be calculated from the supplied text. The percentage is a share, not a statement that PHP creates 70% of every webpage or handles every part of each site.

In practical terms, PHP can be one component of many different services. A news site, public-service portal, or tax website may use it to generate pages or process requests. If the same widely deployed software contains a serious flaw, many operators must review their systems at the same time. That shared dependency creates the risk of a broad disruption.

The figure explains why the reports describe the issue as a threat to much of the web. It does not prove that every PHP-using website was vulnerable, offline, or attacked. Operators still need to check their versions, configurations, and safeguards. The source gives the scale as nearly 70%, not a precise global website total.

A serious flaw in PHP can create a path for an attacker to interfere with a website or the server running it. The exact danger depends on the vulnerability. Possible outcomes include altered pages, unavailable services, stolen information, or unauthorized control. The supplied article text does not say which of these outcomes occurred.

The practical example here is a website that suddenly becomes inaccessible or displays a maintenance message. Operators may do this to stop new requests while they update PHP, inspect logs, test the application, and check connected systems. Taking a service offline does not prove that it was attacked; it can be a precaution against exploitation.

The reports describe websites worldwide being forced into emergency maintenance because of two PHP flaws. They do not provide a confirmed breach count or identify stolen data. The continuing priority is to fix affected software and verify systems before reopening. Services may return gradually, depending on the checks required by each operator.

PHP is a server-side programming language. It runs on a web server rather than directly in the visitor’s browser. Developers use it to build pages whose content can change, handle forms, connect applications to databases, and provide online services. The server sends the resulting response to the browser.

For example, a news page can use PHP to retrieve an article, assemble its layout, and return HTML when someone visits. A tax service might use server-side code to process a request and present the appropriate result. Because PHP is part of the server environment, a flaw in it can affect many applications that depend on that environment.

The source says PHP is used by nearly 70% of websites and links two major flaws to worldwide emergency maintenance. That figure explains the concern, but not every PHP site is necessarily vulnerable. Operators must identify affected versions or configurations, apply fixes, and test services before restoring normal access.

After a vulnerability is discovered, website operators first determine whether their software is affected. They commonly install the vendor’s security update, replace vulnerable components, review settings, and examine logs for suspicious activity. They may also restrict access temporarily while those steps are completed. These actions reduce exposure but do not remove the need for testing.

The clearest example in the source is the sudden appearance of maintenance pages. A maintenance period can block normal visitors while administrators update PHP and verify the application. Operators may also use network filtering, monitoring, backups, and access controls as additional safeguards. The precise measures depend on the flaw and the service.

The reports describe websites around the world being forced into emergency maintenance. They do not state which patches were available, how long the shutdowns lasted, or which operators completed repairs. The forward step is careful recovery: apply fixes, check for compromise, test functionality, and reopen services only after the risk is better controlled.

When someone enters a web address or clicks a link, the browser sends a request to a web server. The server receives it and determines which application should handle it. If the site uses PHP code can run on the server to decide what content or action is needed. The server then prepares a response.

For a news story, PHP might retrieve the requested article, combine it with page elements, and produce HTML. For an online service, it might validate submitted information, consult a database, and return a result. The browser receives the response and renders the page. The visitor normally sees the result, not the server-side PHP code.

This flow matters because a PHP vulnerability sits in the machinery handling requests. A malicious request may exploit a weakness before the server sends its response. The supplied source does not explain a specific exploit, but it connects two PHP flaws with widespread emergency maintenance. Operators therefore had to protect the server-side layer.