Critical PHP Security Vulnerabilities Prompt Global Outages and Urgent Patching

Governments, businesses, and organizations worldwide are rushing to apply emergency software updates following the discovery of two critical security vulnerabilities in PHP, a foundational programming language that powers an estimated 70% of the world's websites. The flaws, designated with a severity score of 9.2 out of 10, involve an out-of-memory handling bug and a use-after-free memory error. These weaknesses could potentially allow unauthenticated attackers to remotely control web servers and execute code without needing a password or legitimate account access.

The security issues were uncovered by researchers utilizing advanced artificial intelligence models. Security firm Calif, working with OpenAI, reported the first flaw in August, while Alphabet-owned Wiz discovered the second. Alphabet's Wiz described the findings as ranking among the most severe vulnerabilities in software history, noting that the underlying flaws had remained hidden for decades until AI tools enabled researchers to chain together complex attack paths.

In response to the discoveries, authorities across Europe, Asia, and other regions took precautionary measures by temporarily shutting down government websites and administrative portals while applying necessary security patches. In the United Kingdom, officials confirmed that 32 government services were taken offline and four were partially unavailable, though Downing Street stressed that no major public-facing critical systems were compromised. Similarly, nations including France, Germany, the Netherlands, Belgium, Finland, and the Czech Republic suspended select online services as a preventative step.

The United States National Security Agency (NSA) issued a rare public warning advising organizations to prepare for immediate updates or take vulnerable websites offline. Cloudflare CEO Matthew Prince reported a massive surge in exploitation attempts immediately surrounding the public disclosure, with scanning and attack volumes jumping from thousands to millions within hours across the network.

PHP developers released emergency updates addressing the bugs in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35, strongly urging administrators to patch their systems immediately. However, security experts warned that millions of internet-facing installations running unsupported legacy versions, such as PHP 8.1 and older, remain exceptionally vulnerable because they will not receive official patches from maintainers.

While officials emphasized that taking websites offline is largely a responsible protective measure rather than proof of a successful breach, cybersecurity professionals warned that third-party dependencies and lingering legacy systems could leave parts of the web exposed for weeks or months. Organizations have been directed to consult official guidance from cybersecurity agencies to mitigate risks and safeguard their server infrastructure.