Government agencies in Europe, Australia and elsewhere took websites offline this week after developers of PHP, the programming language behind a large share of the web, disclosed two critical security flaws. Fixes are now public, but security researchers say many servers have not yet been updated and that attacks have already begun.

What happened

PHP developers disclosed the two vulnerabilities on Tuesday, October 20, Global News reported. Officials said all PHP versions from PHP 5 onward could be affected, although the PHP project had not yet said precisely which versions were vulnerable. A report carried by KSL says PHP released urgent fixes on Wednesday and urged everyone to “update immediately.”

The flaws were reportedly found with the help of AI. The security firm Calif says it found them using a large language model and had worked on a fix since August 1, according to the KSL-carried report. Wiz said it found them with its own AI tool, along with models from Google and OpenAI, and that they had been hidden in the PHP code for more than a decade. Early reports gave no technical details, CVE identifiers or severity scores, so we cannot describe how the bugs work.

Who went offline

• Australia: cyber.gov.au and other government sites reported outages, the Australian Signals Directorate said. A spokesperson for Home Affairs Minister Tony Burke said “some websites are temporarily unavailable as work is undertaken to mitigate risks.”
• Netherlands: the National Cyber Security Centre went offline as a precaution, and reports list other sites, including the Port of Rotterdam, the government portal Overheid.nl and several hospital websites.
• Finland, Denmark and France: state IT provider Valtori took public network services offline “as a precautionary measure”; Denmark’s Kombit shut several services, including a national school communication platform; and France’s Interior Ministry put its websites into preventive maintenance.
• Others: Wikipedia’s operator took some systems down, and the Internet Archive briefly went offline. Japan’s prime minister, Sanae Takaichi, told site owners to “check whether your live site uses PHP and prepare to apply the new fix.”

Why the risk is so wide

PHP runs about 75% of websites whose language can be identified, according to W3Techs figures cited by ABC Australia. WordPress, which runs on PHP, powers about 43% of all websites. Drupal, Joomla and Magento also depend on it. Attackers can scan the internet for vulnerable servers instead of picking victims one by one.

Cloudflare’s CTO Dane Knecht said, “We are seeing early attacks emerging and are updating mitigations as new vectors show up.” Cloudflare added firewall rules, but he warned: “This is a STOPGAP only.”

Censys data cited in the KSL-carried report says about 1.5 million of 2.6 million hosts it checked run a PHP version with no fix. Small sites on shared hosting are at higher risk, according to the same report. Wordfence warned that automatic WordPress updates will not install the fix, because PHP is updated at the server level. Automattic said WordPress.com and Tumblr users are safe.

What about India?

We found no confirmed report of Indian government websites being taken offline, and no advisory from CERT-In, at the time of writing. That is not proof that Indian sites are safe. PHP is widely used across Indian government, banking and commercial sites, and the same exposure applies wherever servers run unpatched versions. Indian organisations should check with their hosting providers and IT teams.

What site owners can do

• Find out who updates PHP on your server: your host, your IT team or you.
• Install the PHP fix as soon as it is available for your version, and confirm the version afterwards.
• Treat firewall rules as a stopgap only. “Updating is the only safe choice,” one summary of the guidance says.
• Watch official PHP guidance and your national cybersecurity agency for further advisories.