PHP: Companies scramble to fix cybersecurity flaws forcing websites offline

Governments and businesses across the world are scrambling to fix two urgent cybersecurity flaws in a programming language that runs around 70pc of the internet.

The problems were uncovered in the PHP programming language, with a fix issued on Wednesday afternoon.

A UK government spokesman called on “all organisations, private and public, large and small” to urgently follow advice to safeguard their systems.

They added: “Work is already under way across government to actively identify and patch any potential exposure.”

Several governments, universities, businesses and local authorities, including in Britain, have closed their sites as they race to fix the problems.

Security experts said the flaws exposed websites and users to a possible hack by criminals, urging owners to shut down.

Councils in Edinburgh, Oxford and Bristol were among those taking down their sites.

France’s interior ministry, the Finnish government, Dutch parliament and several European universities have also taken sites offline, as has the notorious anonymous forum 4chan and a string of social media websites and business services.

The Port of Rotterdam, Europe’s biggest shipping hub, also took down its website on Wednesday.

The flaw relates to the widely used PHP protocol, which allows websites to retrieve information from databases.

It emerged on Wednesday that the vulnerability, which has existed for a decade, was discovered using AI tools from OpenAI, the maker of ChatGPT, and Google.

Wiz, a cybersecurity company, said it had used OpenAI’s GPT-5.6 Sol and Google’s Gemini 4 Argon to detect the vulnerabilities. Advances in AI have led to warnings of a cybersecurity nightmare as tools are used to discover flaws that could then be exploited by hackers.

Wiz said: “These findings rank among the most severe vulnerabilities discovered in PHP and arguably in software history.”

It said the flaw had been discovered in August. The White House said it had been notified last week.

The US National Security Agency on Wednesday urged organisations to take websites offline if they cannot immediately fix two serious security flaws in PHP, a programming language behind a large share of the world’s websites.

The flaws “often provide a direct path to the server’s file system or database”, the agency said in a statement posted on X.

The Dutch cyber security agency was also taken offline, with a message saying: “Due to vulnerabilities in PHP, we have temporarily taken our website (NCSC.NL) offline as a precaution.”

The foundation behind the PHP software revealed on Tuesday the existence of two “critical vulnerabilities”. They released urgent new fixes and urged all users “to update immediately” on Wednesday.

The National Cyber Security Centre (NCSC), an arm of GCHQ, told website owners to take their systems offline if they are unable to immediately respond to the problem.

It followed a warning from the European Union Computer Emergency Response Team (CERT-EU) that the vulnerabilities could let hackers run malicious code on vulnerable systems without logging in.

Cybersecurity agencies in Australia and Japan made similar warnings, urging PHP users to take their websites offline until the vulnerabilities can be fixed.

Sanae Takaichi, the prime minister of Japan, put out an “urgent” call on X for organisations to update their websites or take them offline.

Dane Knecht, the chief technology officer of security company Cloudflare, said the company was already seeing the vulnerabilities exploited by hackers.

“We are seeing early attacks emerging and are updating mitigations as new vectors show up,” he wrote on X.

Hackers can gain direct access

PHP is a link between public-facing websites and the private databases that store users’ information and other details.

A flaw in the protocol could allow hackers to gain direct access to these databases, potentially enabling them to steal data.

“The NCSC is encouraging UK organisations to prepare for immediate updating of systems using PHP. Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated,” the cyber agency wrote.

It said that companies should monitor their PHP systems and apply updates as soon as possible.

The Wikimedia Foundation, which ​runs online ‌encyclopaedia Wikipedia, said it was in the process of ‌addressing ‌security ⁠vulnerabilities in the PHP programming language.

Jake Moore, of cybersecurity company ESET, said: “The sheer scale of PHP across the internet makes this far more serious than the usual exploit.

“A serious vulnerability in technology used by millions of websites could immediately give cybercriminals an enormous number of potential targets.

“Criminals are known to be extremely quick to exploit any given opportunity and even a short delay in patching could leave lots of businesses exposed.”

PHP was invented by Rasmus Lerdorf, a Danish-Canadian programmer, in 1993, but it is now run by a foundation of companies that use the system.