Please follow us on Gab, Minds, Telegram, Rumble, Truth Social, Gettr, X, Youtube, Instagram
Two critical vulnerabilities in PHP, the programming language used by around 70% of all websites on the internet, were disclosed Wednesday. As a precaution while fixes are being distributed, governments across Europe have taken websites offline, TechCrunch reported.
The U.S. National Security Agency recommended in the wake of disclosure of the new PHP flaws that websites that cannot be patched should be taken offline immediately until they can be. The PHP project released fixes for the two newly discovered security bugs on Wednesday in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, according to the PHP Foundation. Both flaws allow an unauthenticated attacker to execute arbitrary code on a server affected by them. One of the flaws corrupts memory when a request hits PHP’s memory limit at a specific point. In the other, a fatal error can leave the server pointing to the wrong memory location, memory from an earlier request. The Foundation said both flaws sit in code paths that nearly every request to PHP takes through. PHP 8.1 and earlier versions of the scripting language are no longer supported by the PHP project.
The security bugs, which could allow hackers to take control of a server, have apparently been lurking in PHP for years, in versions going back to PHP 5, which was launched in 2004. They were discovered by artificial intelligence, according to TechCrunch. A security firm called Calif used OpenAI’s GPT-5.6 Sol model as part of the “Patch the Planet” initiative by OpenAI to discover one of the bugs in PHP, described in a blog post by the AI company. Separately, the Wiz team at Google discovered several other security bugs in PHP using its own AI agent, as well as GPT-5.6 Sol and Gemini 4 Argon. Both followed responsible disclosure and worked with PHP on patches before going public.
According to reports, Finland’s state IT provider Valtori took government public network services offline, the French Interior Ministry put its online services into preventive maintenance, and the National Cyber Security Center of the Netherlands even took down its own website. Hospitals, the Port of Rotterdam and the online services of several national soccer associations also suspended service temporarily.
No exploits have been seen yet in the wild, and OpenAI said the vulnerabilities were discovered by researchers before they could be exploited by hackers. The U.S. Cybersecurity and Infrastructure Security Agency published an advisory for the vulnerabilities and said that it had not seen any exploitation of the flaws as of the time of the advisory. “While CISA has not observed exploitation of these vulnerabilities as of the time of publication, they pose a risk to organizations if left unpatched,” the agency said.
But there is a time constraint. Wiz warned on its blog that AI removes the barrier that once protected old bugs like these. “With AI this is no longer a barrier. LLMs can help adapt an exploit to different PHP versions, configurations and memory layouts,” the company wrote. Now that the flaws are public, hackers know about them too, and the race is on to patch tens of millions of websites before they are attacked.
WordPress, built on top of PHP, notes that the security flaw is not specific to the website builder or content management system and that owners of sites using the software must patch their servers. The fixes will need to be applied in conjunction with the site owner’s hosting company.
One flaw was first spotted by a researcher in 2024, but no attack path could be found at the time, so it was left while other issues were fixed first. The PHP Foundation called the delay “a structural failure,” blaming the security team’s decision process and its lack of resources. The Foundation said the process for dealing with security issues is being changed.
Get the latest on NYC and the Empire State delivered straight to your inbox
