Zoltán Tanács, Hungary's Minister for Science and Technology, announced Thursday morning that magyarorszag.hu and several other government websites were taken offline as a precaution due to a multi-country, critical cybersecurity risk. The threat was mitigated by Thursday afternoon and the site was restarted.
The incident involved two vulnerabilities in PHP, a widely used server-side programming language. Exploiting the bugs made it possible to run code on a PHP-based web server without authentication and to read sensitive data — such as passwords or API keys — from server memory.
Scope and why the flaws were severe
PHP powers a large share of the web: W3Techs reports that nearly 70 percent of sites with publicly known server-side technologies use PHP. Popular platforms such as WordPress and MediaWiki (which runs Wikipedia) rely on it. A language-level vulnerability therefore has the potential to affect many sites.
The two vulnerabilities were identified by Calif and Wiz, two cybersecurity firms, and independently by OpenAI. They worked with advanced AI models via the OpenAI-led Patch the Planet initiative. Researchers published a demonstrator script called php2shell that combined the issues and showed how an attacker could execute remote code on a server without logging in.
That ability is particularly dangerous because typical compromises require gaining credentials or exploiting an application-level flaw; here the attack could be automated and scaled, allowing scripts to scan and attempt exploitation across the internet.
Discovery and the role of AI
Calif traced the problem to a memory-management related bug that had been known in part previously but was not proved exploitable until now. OpenAI independently reached a similar conclusion, and Wiz also found additional attack vectors. The researchers say that manually proving memory-related vulnerabilities is slow and complex, but large language and other advanced models accelerated testing and helped to demonstrate practical exploitability.
Models cited by the companies include Wiz’s Atlas model, Google’s Gemini 4 Argon, and OpenAI’s GPT-5.6 Solla; these systems shortened the time needed to test and validate potential exploits.
Timeline, leaks and patch rollout
The PHP Foundation had been working on fixes since September and initially planned a public announcement for October 22. On October 20, information about the vulnerabilities began circulating on online forums, prompting the PHP team to bring forward its notification and the release of patches.
That same day Calif posted a php2shell video and removed it shortly after; the early circulation helped others confirm the exploitability. Chainguard, another cybersecurity firm that had received patches under embargo, published the fixes hours before the embargo lifted, drawing criticism. Amazon reported attempted exploitation as early as October 17, and multiple active attempts were observed on October 20 and 21.
Available fixes and recommended actions
Patches addressing the vulnerabilities are available for PHP 8.2 and later. However, W3Techs data indicate roughly 31 percent of known sites still run PHP 7 or older, versions that do not directly receive these updates. The PHP Foundation has highlighted this and is offering guidance to users who cannot immediately upgrade, but notes that moving to a supported, updated PHP release is the comprehensive solution.
Cloud providers and services including AWS and Cloudflare published mitigations and interim measures prior to the official patch release to reduce exposure.
Security authorities and incident response teams strongly urge administrators to install the available updates as soon as possible. If immediate patching is not feasible, the recommended steps are to temporarily take vulnerable services offline and implement the mitigation measures published by the PHP Foundation and major cloud providers.
What this means going forward
The episode underlines the importance of coordinated disclosure, patch management and upgrade cycles: had the patches and communications been synchronized with the original schedule, the public impact might have been smaller. Because details leaked in advance and some parties released information early, many organizations had to react quickly — including taking public sites offline — to avoid compromises.
For any operator running PHP, the immediate tasks are clear: check the PHP version, apply PHP 8.2+ patches where possible, or remove affected services from the network until they can be upgraded. Given that the public availability of the fixes makes it likelier that exploit methods will be developed, timely action is essential.
