Inside Critical PHP Vulnerabilities That Have 70% Of The Internet At Risk

by · Inc42

SUMMARY

  • The vulnerabilities could potentially give attackers a direct path to a server’s file system or database and execute arbitrary code on the host server
  • PHP powers more than half of the Internet, with OpenAI describing the episode as “one of the most impactful security issues in recent memory”
  • Finland has shut down state internet services, while the Netherlands’ cybersecurity agency has taken its website offline. France, too, has temporarily taken certain websites down
  • Added to Saved Stories in Login

A pair of critical vulnerabilities in PHP, the open-source programming language that powers much of the modern web, has forced governments and companies across the globe into emergency action. 

The vulnerabilities, identified as part of OpenAI’s “Patch the Planet” initiative and flagged separately by Google’s cybersecurity wing Wiz, could potentially give attackers a direct path to a server’s file system or database. 

For an internet ecosystem built largely on top of open-source components, this is a code-red scenario. The vulnerabilities were flagged by AI, and a fix was issued on Wednesday afternoon.

The response has been unusually broad. Finland has shut down state internet services, while the Netherlands’ cybersecurity agency has taken its website offline. France, too, has temporarily taken certain websites down. 

India’s CERT-In (Computer Emergency Response Team) and the US National Security Agency (NSA) have also advised organisations using PHP to update their systems or take their affected systems offline until immediate patching is not possible. Japanese Prime Minister (PM) Sanae Takaichi, in a post on X, urged people to check if their publicly available websites ran on PHP.

The Wikimedia Foundation, which runs the online encyclopedia Wikipedia, said it was addressing the security vulnerabilities. This led to some users experiencing issues accessing the website on Thursday. 

The episode is significant not only because of the severity of the flaws but also because of how they were found. OpenAI said its GPT-5.6 Sol model identified one critical flaw, while Wiz independently discovered and reported both vulnerabilities. 

OpenAI described the episode as “one of the most impactful security issues in recent memory”, arguing that the development demonstrates both the defensive potential of AI and the growing risk that the same capabilities could help attackers develop exploits faster.

For organisations running PHP-based websites, applications and APIs, the immediate priority is to identify exposure, apply vendor patches and assess whether systems may already have been compromised. The wider tech industry is also rushing to coordinate and mitigate any problems emerging from the fracas. 

So how did the two flaws, which affect nearly every website on the internet, suddenly come to light? 

More Than Half Of Internet At Stake

PHP is a server-side programming language that is used to build websites and web apps. It processes user requests, connects to databases and often controls access to sensitive backend systems. Because it sits between the public internet and an organisation’s data, a flaw in PHP can have consequences far beyond a single website.

The newly disclosed vulnerabilities could allow attackers to reach a server’s file system or database. In practice, that means an attacker may be able to read, modify or delete files, access stored credentials, extract customer data or move deeper into an enterprise infrastructure.

At the heart of the crisis are two interconnected flaws rated 9.2 on the Common Vulnerability Scoring System (CVSS) severity scale.

The bugs exploit deep memory-handling mechanisms inside the PHP execution core. This allows unauthenticated external attackers to send crafted web traffic, bypass security checks, and execute arbitrary code directly on the host server.

Making matters worse, these flaws aren’t restricted to modern builds. These vulnerabilities are believed to have existed in every version of PHP since version 5, which was first released in 2004. 

RECOMMENDED FOR yOU