Government and private-sector websites worldwide were taken offline or urgently updated on Wednesday after developers of PHP, a widely used programming language, released emergency patches for two critical vulnerabilities. The flaws, rated 9.2 out of 10 on the CVSS v4.0 severity scale, allow unauthenticated remote code execution, meaning attackers could take control of servers without credentials. Cybersecurity agencies in the EU, U.S., Australia, Japan, and the U.K. advised organizations to apply fixes immediately or temporarily shut down affected systems.
PHP developers release patches ahead of schedule
The PHP development team released updates at 1400 GMT on Wednesday, addressing two vulnerabilities that could permit attackers to execute malicious code on vulnerable servers. The flaws stem from how PHP handles server memory, enabling exploitation through improper memory handling and reuse of freed memory. OpenAI contributed to the discovery of the vulnerabilities, stating their AI models identified the issues before widespread exploitation could occur. The company described the bugs as among the most impactful in recent memory due to PHP’s dominance across the internet.
Global response: Websites go dark or update urgently
Government agencies in Europe, Australia, and the U.S. reported disruptions, with some taking websites offline as a precaution. Australia’s cybersecurity website (cyber.gov.au), operated by the Australian Signals Directorate, was among those affected. The European Union’s CERT-EU and the U.K.’s National Cyber Security Centre (NCSC) urged immediate patching or temporary shutdowns for systems unable to update. Cloudflare, a major internet infrastructure provider, reported early signs of attacks and updated firewall rules as a stopgap measure.
Scope and potential impact
PHP powers nearly 70% of all websites with identifiable programming languages, including WordPress (40% of all websites), Facebook, Wikipedia, and government portals. The vulnerabilities could lead to data theft, website defacement, or servers being repurposed for further attacks. Cybersecurity firm Huntress noted that PHP underpins WordPress, Drupal, Joomla, Magento, shared hosting platforms, and control panels, many of which do not explicitly disclose their reliance on PHP. Patchstack reported receiving confirmed reports of active exploitation, though the full extent of attacks remains unclear.
What organizations and users should do
- Apply the PHP updates immediately if running affected versions.
- Monitor official PHP advisories for further guidance.
- Consider temporary shutdowns for systems unable to patch immediately.
- Review server logs for signs of compromise if systems were exposed before updates.