Security researchers discovered two serious vulnerabilities in the PHP programming language that can allow attackers to execute code remotely without authentication. Following the disclosure, several countries temporarily took government and public-service websites offline on Wednesday as a precaution, with warnings that the flaws could put millions of servers worldwide at risk.
What happened and when
The vulnerabilities were found by cyber-security researchers at Calif and Wiz, who said the bugs may have gone unnoticed for more than a decade. To locate the flaws they used advanced artificial intelligence models developed by OpenAI; Wiz wrote that those models were essential in developing working exploit techniques within hours.
PHP developers released security patches on Wednesday afternoon.
Actions and impacts across Europe
- After the vulnerabilities became public, parts of the websites of Wikipedia, DeviantArt and the BBC were temporarily inaccessible.
- In the Netherlands, authorities proactively disconnected online systems including the Port of Rotterdam, the government services portal, several hospitals and the websites of the five largest political parties; the national cybersecurity centre also took its own website offline.
- Finland suspended several government internet services.
- Denmark disconnected a nationwide system used for communication between schools and parents.
- In France, the Ministry of the Interior temporarily took down some local government websites.
These outages were precautionary measures; there have been no confirmed reports that the affected government systems were breached.
Security providers and exploitation attempts
Cloudflare reported that it detected attempts by attackers to exploit the vulnerabilities before official patches were published. Experts warned that typical updates to WordPress or other content management systems are not sufficient — the PHP runtime on servers must also be updated.
Calif and Wiz described the AI-assisted discovery as revealing some of the most severe vulnerabilities found so far by such technology. Wiz estimated the issue could affect "about 70%" of the internet, a figure the BBC said it could not independently verify.
Response in Hungary
The Nemzeti Kiberbiztonsági Intézet (National Cybersecurity Institute) issued an alert about the critical vulnerabilities and urged immediate deployment of the available fixes. The institute recommended temporarily disconnecting affected systems from the internet or shutting them down where rapid patching was not possible.
Why this matters
PHP is widely used to power websites and web services, so critical flaws in the language can expose a large number of servers and services to remote code execution, data loss or service disruption. Security teams stress that installing the server-side PHP updates is essential to mitigate the risk.
