Is the website down? What to know about the global PHP security scare

PHP is a programming language created in the early 1990s. It helps websites perform their underlying functions. The article describes it as “a backbone of the web” because so many online services depend on it.

PHP supports popular web design platforms. That means it can sit beneath online stores, government services, blogs and other websites. Visitors may never see PHP directly, but their websites can rely on its code to work properly.

Its importance also creates risk. A problem in PHP can affect many organisations at once, especially when websites share platforms or third-party services. The PHP Foundation released a fix and urged every organisation running PHP to update immediately. The incident shows why widely used software requires rapid security maintenance.

The article estimates that PHP helps run 70 per cent of the world’s websites. That makes it unusually widespread. PHP is not simply one website’s software; it supports popular web design platforms used by many organisations.

A vulnerability in such a common foundation can spread risk across very different services. The article points to online stores and government services as examples. It also reports that websites including the Paris police website and a Pokemon sleep tracker went dark while developers protected their code.

The global impact comes from dependence and interconnection. Organisations may run PHP directly, or rely on third-party interfaces that use it. Even after one organisation patches its own systems, an unpatched third party may remain exposed. The article warns that smaller sites and user-run blogs could stay vulnerable for days, weeks or months.

The article does not describe the vulnerabilities’ technical details. It identifies them as critical weaknesses hidden in PHP for more than a decade. These flaws could allow hackers to break into websites built on PHP-supported platforms.

Wiz Research and other groups found the weaknesses in August using cutting-edge AI models. Security firm Calif separately found them during an Axiom-funded audit of PHP’s code. The researchers kept the discovery private while developers prepared a fix, limiting the chance that the details would be weaponised.

A fix was released Wednesday. The PHP Foundation told organisations that updating was imperative. The urgency comes from the software’s enormous reach and the danger that vulnerability information could spread quickly. Axiom called the flaws among the most impactful in recent memory and said the discovery showed AI finding bugs with internet-scale consequences.

Websites went offline because their operators were responding defensively. Taking a service down can reduce exposure while developers inspect systems and apply the PHP security update. It does not automatically mean attackers have already entered.

Dimitrios Salampasis said taking websites offline does not necessarily mean they were hacked. The article gives examples including the Paris police website and a Pokemon sleep tracker. Their operators were working to protect the underlying code from possible attacks.

So far, Steve Kerrison said security researchers had seen no evidence that anyone was actively using the available techniques. However, unpatched systems could still be targeted later. Larger institutions may update quickly, while smaller sites and user-run blogs may remain exposed for days, weeks or months. Those sites could help spread computer viruses, spam or malicious content.

AI helped by examining PHP and identifying weak spots that researchers had not found for more than a decade. The article links this capability to cutting-edge models from Axiom and Google, used by Wiz and other groups.

Wiz Research used AI to find vulnerabilities hidden in PHP. Separately, security firm Calif found the flaws during an Axiom-funded audit of PHP’s code. The discoveries happened in August. The groups kept the findings private while a fix was developed, because public details could be weaponised quickly.

The discovery matters because PHP supports a huge share of websites. Axiom described it as a new phase in which AI can find security bugs with internet-scale impact. AI did not itself launch attacks in the article’s account. Instead, it accelerated defensive research and gave developers time to prepare and release an update.

Installing the PHP fix protects an organisation’s own updated code, but online services often depend on other systems. The article highlights complex, interlinked networks and third-party interfaces. Those connections can preserve risk after a direct patch.

Rahat Masood explained that if third parties use PHP, an organisation can remain insecure even after patching itself. A website may therefore depend on another service whose software, maintenance or update process it does not fully control. The article does not identify a particular third-party system that remained vulnerable.

This means security work cannot stop at one update. Organisations must consider connected providers and continue checking their systems. Smaller operators may struggle to respond quickly, while user-run blogs could remain vulnerable for days, weeks or months. The article also warns that personal information from a breach could later support phishing attacks.

In general, a software vulnerability is a weakness or mistake in code that lets software behave in an unintended way. Attackers can search for such weaknesses because they may provide a route around normal security controls. The article describes the PHP flaws as critical vulnerabilities but gives no technical details.

If exploited, a flaw could allow an attacker to break into a website or system. Once inside, the attacker might access or alter data, disrupt services, or use the system to distribute malicious content. The article specifically mentions possible viruses, spam and malicious content, plus phishing risks if personal information is exposed.

The current evidence is more limited. Steve Kerrison said researchers had seen no active attacks using the available techniques. Organisations still acted urgently because vulnerability details could be weaponised quickly, and unpatched sites may remain exposed for days, weeks or months.