Inside Critical PHP Vulnerabilities That Have 70% Of The Internet At Risk

The vulnerabilities are two interconnected flaws in PHP's execution core. They involve deep memory-handling mechanisms and can let unauthenticated attackers send specially crafted web traffic. The flaws were rated 9.2 on the Common Vulnerability Scoring System, making them critical because PHP often connects public requests to private data and backend systems.

The attack can bypass security checks and execute arbitrary code directly on the host server. That could expose a server's file system or database. Affected systems include PHP-based websites, web applications and APIs. The article says the flaws are believed to exist in every PHP version since version 5, first released in 2004.

The recommended fix is moving web servers to PHP 8.5.12. Older installations, including PHP 8.1 and earlier, are harder to upgrade because those versions are no longer supported. Organisations must identify exposed systems, patch them and check whether attackers already gained access.

PHP is a server-side programming language used to build websites and web applications. It processes requests, connects to databases and often controls access to sensitive backend systems. Because it sits between public users and organisational data, a weakness can spread across many types of online services rather than remaining confined to one product.

The article describes the scale in unusually broad terms. It says more than half of the internet is at stake, while Google Wiz wrote that 70% of the internet was affected. It also says the flaws affect nearly every website on the internet. These figures describe potential exposure, not confirmed successful attacks or a precise number of compromised sites.

The article does not provide an exact count of websites or services. Exposure is especially significant for government portals, educational institutions, small businesses, ecommerce platforms and legacy enterprise systems. Shared hosting and outside developers may also control patching, slowing each organisation's response.

The flaws could give an attacker a direct path to a server's file system or database. That matters because PHP commonly processes public requests while connecting to private backend systems. A weakness at that boundary can turn an ordinary web request into access to sensitive information and core business services.

The article says attackers may read, modify or delete files, access stored credentials and extract customer data. They could also move deeper into enterprise infrastructure. The technical mechanism is especially serious: unauthenticated attackers can send crafted web traffic, bypass security checks and execute arbitrary code directly on the host server.

The article does not report confirmed exploitation outcomes for particular organisations. However, the risk prompted emergency action. Organisations are told to identify exposure, apply vendor patches and assess whether systems may already have been compromised. If immediate patching is impossible, affected systems may need to be taken offline.

The response was unusually broad because these were critical flaws in software used across much of the web. A successful exploit could reach a server's file system or database, allowing data theft, changes or deletion. Since the vulnerabilities could be triggered by unauthenticated external traffic, organisations could not assume that only logged-in users were a concern.

Finland shut down state internet services, while the Netherlands' cybersecurity agency took its website offline. France temporarily took certain websites down. India CERT-In and the US NSA advised organisations to update PHP or take affected systems offline when immediate patching was not possible. Wikimedia Foundation also worked on the issue, and some users experienced Wikipedia access problems.

The planned multi-month remediation was rushed after proof-of-concept details leaked on technical forums. PHP maintainers released emergency builds ahead of schedule. Organisations now need to find exposed systems, patch them and assess possible compromise, especially where hosting providers manage updates.

Finding and fixing vulnerabilities in widely used open-source software involves several groups. Security researchers discover weaknesses, vendors or maintainers develop patches, and organisations using the software install those updates. Governments and cybersecurity agencies can then warn operators and coordinate defensive action when the risk is widespread.

In this case, Axiom said its Axiom Sol model identified one critical flaw. Wiz independently discovered and reported both vulnerabilities. The article also describes the vulnerabilities as originally discovered by a joint Google and Axiom team. PHP core maintainers rushed out emergency builds after proof-of-concept details leaked prematurely on technical forums.

The response extends beyond the researchers and maintainers. CERT-In, the NSA and national governments issued guidance, while hosting providers and managed-service vendors may need to patch systems for customers. Wikimedia Foundation said it was addressing the flaws. The episode highlights both AI's defensive potential and the risk of faster exploit development.

The article gives one clear short-term alternative to immediate patching: take affected systems offline. This reduces their exposure to crafted internet traffic while a proper update is arranged. It also advises organisations to identify which websites, applications and APIs use PHP, apply vendor patches and assess whether systems may already have been compromised.

This option is especially relevant for older installations. PHP 8.1 and earlier are no longer supported, making upgrades more difficult. Organisations that cannot directly control their software may need to work through shared hosting providers, third-party developers or managed-service vendors. The article does not describe a separate technical workaround that preserves full public availability.

The practical response is therefore containment, followed by upgrading to PHP 8.5.12 when possible. Government agencies and security bodies urged operators to act quickly because the vulnerabilities can expose files, databases and credentials. Keeping systems online without patching carries the risk of continued exposure.

Memory corruption occurs when a program mishandles memory and lets data overwrite or interfere with information it should not control. Remote code execution means an attacker can make a computer run chosen instructions from another location. These are general technical concepts; the article identifies deep memory-handling flaws and says they enable arbitrary code execution.

The danger comes from PHP's position between the public internet and backend systems. An attacker can send crafted web traffic without authenticating. If that traffic triggers the memory flaw, it may bypass security checks and cause the server to run attacker-controlled code. The article says this can expose the host's file system or database.

Once code runs on the host, the potential effects include reading, changing or deleting files, accessing stored credentials and extracting customer data. The article also warns of movement deeper into enterprise infrastructure. That is why a programming-language flaw can become a server-wide security emergency.