Major Security Bug Discovered in PHP Language Powering Most Websites

Major security warnings issued by the FBI's cyber division and the organization behind PHP have put governments and companies on high alert over two critical vulnerabilities in the widely used web scripting language.

The Threat

The PHP Foundation warned that these flaws let bad actors gain unauthenticated access to affected websites. Attackers can remotely control web servers without a password, allowing them to steal or alter data and launch further attacks. PHP powers about 70 percent of websites worldwide, including popular platforms like WordPress, Drupal, and Wikipedia's MediaWiki software. The PHP Foundation admitted that a lack of resources and a flawed decision process caused a structural failure that delayed fixes for vulnerabilities known since at least 2024.

Global Impact

Security advisories urged users to patch the flaws immediately or shut down their sites. Several websites went offline as a precaution, leading to disruptions in government services across countries like the United Kingdom, Finland, and Japan. Charl van der Walt of Orange Cyberdefense warned that these outages are only early tremors, while OpenAI and cloud security platform Wiz noted that artificial intelligence played a key role in identifying how the vulnerabilities could be exploited and testing fixes.

Context

PHP is a free, open-source programming language that forms the foundation of a vast share of internet infrastructure, making any widespread security flaw a major global concern. The incident demonstrates how artificial intelligence is transforming digital security by helping both defenders discover critical bugs faster and attackers probe for weaknesses at a larger scale.