What is PHP and why did it take government websites offline?
Government websites across Europe went offline as operators worked to patch two critical PHP vulnerabilities. The flaws are rated 9.2 out of 10 and could allow attackers to run commands on vulnerable servers without an account.
1. PHP vulnerabilities
The developers of PHP said they would release patches for two critical vulnerabilities, and EU cybersecurity officials advised organisations unable to apply the fixes to take affected websites offline. PHP runs nearly 70% of websites whose programming language can be identified and is used by WordPress, which powers about 40% of all websites.
2. Risks to websites
The vulnerabilities are rated 9.2 out of 10 on the CVSS v4.0 severity scale. CERT-EU said the rating signals unauthenticated remote code execution, allowing an attacker to run commands on a vulnerable server over the internet without a password or account. GoDaddy said exploitation could lead to stolen data, defaced pages or full-system compromise, while Cloudflare's chief technology officer said early attacks were emerging.
3. Discovery and response
Researchers at security firm Calif, working with OpenAI, reported the first flaw to PHP on August 11 after finding it with OpenAI's GPT-5.6 Sol model, the company said. Wiz, owned by Alphabet's Google, independently found the flaws and reported a second one on August 24, also using AI models. Wiz said the vulnerabilities had been present for decades.
