Organizations and governments worldwide are racing to address critical cyber-security vulnerabilities discovered within the PHP programming language, prompting precautionary website shutdowns across multiple sectors.
The security issues were uncovered using advanced artificial intelligence tools by researchers at firms including Calif and Wiz. Described by experts as one of the most impactful security events in recent memory, the flaws affect the PHP programming language, which underpins a vast portion of the internet—including content management systems, online shops, and platforms like Wikipedia—by processing information to display web pages.
In response to the discovery, cyber-security agencies such as the UK's National Cyber Security Centre (NCSC), alongside international counterparts, urged website administrators to apply necessary patches immediately. Organizations unable to implement immediate fixes were advised to take vulnerable systems offline as a precaution. Consequently, high-profile entities—including the Office for Budget Responsibility, NHS Scotland, parts of Wikipedia, and various European public web services—temporarily suspended online operations while evaluating their exposure.
Ryan Austin, a researcher at cyber-security firm Calif who helped uncover the issue, noted that while the vulnerabilities are severe and could potentially grant unauthorized access to personal data, coordinated disclosures and rapid patch rollouts by the PHP Foundation and vendors like WordPress have helped mitigate widespread active exploitation.
