Government websites across Europe went dark on Wednesday as operators raced to patch two critical vulnerabilities in PHP, one of the most widely used programming languages on the web. The developers of PHP announced on Wednesday that they would release patches for the two critical flaws, while European Union cybersecurity officials warned organizations unable to apply the fixes immediately to take affected websites offline.
PHP is a foundational programming language that runs behind the scenes on web servers. When a user loads a webpage, the server runs PHP to assemble the content before sending the finished page to the browser. Maintained by volunteers, the software is free, open source, and rarely interacted with directly by site owners.
According to the web technology tracker W3Techs, PHP runs nearly 70% of all websites whose underlying programming language can be identified. It serves as the engine behind WordPress, which powers approximately 40% of all websites, including blogs, small business pages, government portals, online shops, and news sites.
The two newly disclosed vulnerabilities are rated 9.2 out of 10 on the CVSS v4.0 severity scale, representing a standard industry scoring system. CERT-EU, the European Union’s cybersecurity response team, explained that this rating signals unauthenticated remote code execution. This means an attacker can run commands on a vulnerable server over the internet without needing a password or an account.
A single flaw in PHP opens the same door on millions of servers simultaneously, meaning whoever exploits the flaw effectively controls the website. Web hosting provider GoDaddy noted that such a compromise could lead to stolen data, defaced pages, or full-system compromise. Meanwhile, Cloudflare’s chief technology officer stated that early attacks were already beginning to emerge.
Most small websites are typically run by owners with no dedicated security staff, often operating on shared hosting platforms where they do not manage the server directly and may not know who updates PHP. Wordfence, a security plugin for WordPress sites, warned that standard automatic updates will not apply this specific fix. Consequently, CERT-EU’s guidance advised site operators to take affected sites offline rather than leave them exposed to potential attacks.
The discovery of the flaws involved advanced artificial intelligence tools. Researchers at security firm Calif, working in conjunction with OpenAI, reported the first flaw to PHP developers on August 11 after discovering it using OpenAI’s GPT-5.6 Sol model. Simultaneously, Wiz, a security firm owned by Alphabet’s Google, found the flaws independently and reported a second one on August 24, also utilizing AI models.
Representatives from Wiz described the findings as ranking among the most severe vulnerabilities ever discovered in PHP, and arguably in software history. The firm noted that the underlying flaws had been present for decades, but proving they were exploitable required a chain of steps at the edge of what human researchers could practically achieve.
In the United States, the administration of President Donald Trump stated it was tracking the situation and coordinating with federal agencies and leading artificial intelligence labs to expedite the release of the fix. The administration framed the discovery as evidence that American intelligence technology strengthens national security.
