Government agencies around Europe and elsewhere shut down websites on Wednesday after two critical flaws came to light involving PHP, a programming language that is the basis for a large share of the internet.
Developers of the PHP programming language said a set of new updates fixing two previously identified critical vulnerabilities was now live, and acknowledged a delay in addressing a previously identified flaw.
The US National Security Agency urged organisations using the software to install the updates immediately or take vulnerable systems offline.
“Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommended that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance,” it said in a post on X.
Websites could be vulnerable to attack: PHP
The PHP Foundation, which oversees development and maintenance of the software, addressed the flaws as a “structural failure” and said that these releases fix two critical vulnerabilities that, under the right conditions, could allow an unauthenticated attacker to execute code on servers running PHP.
{{/usCountry}}The PHP Foundation, which oversees development and maintenance of the software, addressed the flaws as a “structural failure” and said that these releases fix two critical vulnerabilities that, under the right conditions, could allow an unauthenticated attacker to execute code on servers running PHP.
{{/usCountry}}“If you run PHP, it is imperative that you update now,” it added.
How were the flaws found?
A security researcher first identified signs of one of the vulnerabilities in 2024, but that the issue was "theorized, but no concrete vectors were found and other concrete issues with clear impact overshadowed these concerns.
The PHP Foundation later enrolled the PHP project in the Patch the Planet programme, under which security firm Calif began an audit of PHP on July 30, 2026.
In August, Calif and OpenAI, the company behind ChatGPT, independently reported the flaws on the same day. Google-owned cloud security firm Wiz later identified additional ways to exploit them.
The vulnerabilities were privately reported to PHP’s developers and kept confidential while a fix was being prepared.
‘Bug one of the most impactful vulnerabilities’: OpenAI
OpenAI in a post on X said that its models helped researchers discover critical security flaws in PHP. It called the bug one of the most “impactful vulnerabilities” in recent memory.
“Due to the severity of these flaws and PHP’s widespread use, we consider this bug to be one of the most impactful vulnerabilities in recent memory. It also marks a new phase, where AI can find security bugs with internet-scale impact,” it said.
France, Netherlands shut websites
In France, several local government websites, including that of the Paris Police Prefecture, were taken offline from Wednesday afternoon at the request of the French National Cybersecurity Agency after a critical security flaw was detected, the Interior Ministry said.
In the Netherlands, authorities temporarily shut down the DigiD digital identity service, the House of Representatives website and the national cybersecurity centre’s site as a precaution, Dutch broadcaster NOS reported.
Belgium’s foreign ministry also took its websites offline temporarily as a precaution, according to a post on X. However, the country’s Centre for Cybersecurity said it had not detected any attacks on Belgian websites.
(With inputs from AFP)