PHP flaw forces global site shutdowns and patch race

By Nathan Brooks

The US National Security Agency told every organization using PHP to take its systems offline if it could not patch immediately. The agency said the vulnerability could “provide a direct path to the server’s file system or database.”

The flaw became public on Tuesday, and the organization behind PHP issued a patch on Wednesday after researchers testing cyberdefences found it. The report said PHP, a language used to build much of the web, is used by almost 70% of websites. It also said millions of websites would need to be fixed.

Warnings followed from the US National Security Agency in Washington and the UK’s National Cyber Security Centre in London. Governments in the Netherlands, Germany, Belgium, Finland and France temporarily took websites offline as they scrambled to patch the weakness, the report said. The report identified several specific shutdowns:

• The Wikimedia Foundation said it had taken several systems offline on Wednesday as a precaution until they could be patched.
• The United Kingdom’s Edinburgh, Bristol and Oxford councils took their websites offline.
• France’s Paris police prefecture and other local-government sites went offline on Wednesday.
• The Netherlands took its national digital identity service offline, along with the house of representatives and national cybersecurity centre websites.

Major services also sit on PHP, according to the report. Its footprint includes:

• Wordpress, described as one of the most common website systems.
• Wikipedia and the messaging software Slack, while much of Facebook used PHP historically.

What does the flaw change for website operators?

For website operators, the immediate consequence was a choice between installing Wednesday’s patch and taking systems offline when immediate patching was impossible, the NSA said. The UK NCSC also told organizations to check for “backdoors installed by an attacker.”

Prof Alan Woodward, a cybersecurity expert at Surrey University, said: “It was very surprising and troubling because of the extent to which PHP was used around the world. PHP issued a patch very quickly. The big thing is for everyone using it to get that in to make sure their systems are safe.”

Woodward warned that a long tail of poorly maintained websites could remain vulnerable and sustain attacks for weeks or months. He added: “For the big juicy targets, I hope to goodness they are being patched quickly.”

Woodward described a race in which some organizations may not know they are participating. He said: “There is this race and some people unfortunately don’t even know they are in the race.”

OpenAI said it led a coalition of researchers that discovered the flaw and that “frontier AI” had been key. The researcher who found the weakness said they did not use models unavailable to the general public.

Internet infrastructure expert Michał Woźniak said: “There’s going to be a lot of automatic exploitation of this.” He said the bug might allow cryptocurrency miners to exploit vulnerable servers at other people’s expense.

The report said Russian state actors or organized criminals could exploit the flaw for cyber-attacks. Woźniak said large crime organisations and Russian state actors could use vulnerable sites as launching pads for distributed denial of service (DDoS) and other cyber-attacks.

Woźniak said the episode highlighted the poor state of internet infrastructure. He said advancing AI models had brought the problem into view, although it was long developing, and that the underlying vulnerabilities were decades old.

Woźniak described the conditions this way: “This is an environmental problem in an industry where there’s an incentive to move fast and make changes.” He added: “There’s an incentive to deploy a thing and then never update it and not think about maintenance.”

Woodward’s warning makes duration the forward risk despite Wednesday’s patch. He said unmaintained sites may remain vulnerable for weeks or months, while Woźniak expects widespread automatic exploitation. For operators, the practical test is whether every PHP deployment can take the patch and check for “backdoors installed by an attacker.”