PHP has not disappeared. But two critical security flaws have forced organisations around the world to patch their systems or take some websites offline.
PHP is a programming language used to build websites and web services. It runs on servers and helps deliver the pages and features people use online.
The latest flaws raised concern because PHP is widely used across the internet.
Cybersecurity agencies in several countries have urged organisations to act quickly. They have warned that attackers could use the flaws to gain access to systems, steal data or disrupt websites.
Why are websites going offline?
The two security flaws can allow an attacker to run harmful code on a server without first logging in.
That creates a serious risk. An attacker who gains access could potentially reach server files, affect databases, or take control of parts of a website.
The European Union’s cybersecurity agency, CERT-EU, warned about the risk of remote code execution. This means an attacker may be able to make a vulnerable server run commands from outside.
Several organisations have already taken systems offline as a precaution.
Finland temporarily shut down public government web services. A Dutch government cybersecurity agency also took its own website offline.
The Wikimedia Foundation took some systems down as a safety measure. Parts of Wikipedia became unavailable during the disruption.
A website operated by Edinburgh City Council also became inaccessible. Several BBC programme pages were unavailable, although there was no confirmed link between those outages and the PHP flaws.
The US National Security Agency and other cybersecurity agencies have also advised organisations to take action.
The UK’s National Cyber Security Centre said organisations that cannot fix affected systems immediately should consider taking them offline until they can fully protect them.
Why does PHP matter so much?
PHP may not be visible to most internet users, but it sits behind many websites and online services.
It is used by popular systems such as WordPress, Drupal, Joomla and Magento. Hosting companies and website control panels also use PHP in many cases.
That creates another problem for organisations.
They need to find every system that uses PHP before they can fully understand their risk.
Cybersecurity experts have warned that some organisations may not even know where PHP is running across their networks.
Sophos cybersecurity expert Don Smith said finding and managing every PHP installation could be one of the biggest challenges.
Organisations also need to check whether attackers already gained access before they applied a fix.
That means installing an update alone may not be enough. Security teams should also review system logs for unusual activity.
How were the PHP flaws discovered?
The vulnerabilities were discovered by cybersecurity researchers from Calif and Wiz.
The researchers found the flaws through Patch the Planet, a programme that gives selected security researchers access to advanced AI tools from OpenAI.
The PHP flaws had remained undetected for more than 10 years.
Researchers said advanced AI tools helped them identify and develop working exploits much faster.
Wiz said frontier AI models helped researchers build working exploits across multiple applications within hours.
OpenAI described the discovery as one of the most serious security issues found in recent memory.
The PHP Foundation had planned to release information about the flaws later. However, details were leaked before the planned announcement, which led to an earlier release of the fixes.
Which PHP versions are affected?
The exact range of affected PHP versions was still being assessed when the warning was issued.
CERT-EU said the flaws could affect versions dating back to PHP 5, which was released in 2004.
The PHP Foundation has provided fixes for supported versions. Organisations running PHP 8.1 or older have been urged to upgrade.
The wider problem also involves software that includes PHP.
The UK National Cyber Security Centre has warned organisations to keep checking for updates from third-party software providers that bundle PHP into their products.
Cloudflare Chief Technology Officer Dane Knecht also said the company had seen early attacks linked to the flaws and was updating its protections.
What should organisations do now?
The first step is to find every PHP-based website, application and server.
Organisations should then check the PHP version running on each system and apply the relevant security update.
They should also review system logs for signs of unusual activity. This can help identify whether someone may have accessed a system before the update.
If an affected system cannot be updated quickly, organisations should restrict its internet access or take it offline where possible.
The PHP issue does not mean the programming language is going away.
Instead, the incident has exposed the risk of running old software across a large and connected internet ecosystem.
For organisations, the immediate task is clear: find every PHP installation, update vulnerable systems, check for signs of attack and keep monitoring for further security updates.
AI & Technology Online Scam Public Notice
Last modified: October 22, 2026
