The language that's known as the backbone of the internet is now subject to what experts describe as one of the most notable vulnerabilities in recent memory.
PHP is a widely used general-purpose scripting language that is geared towards web development, and thus, it powers the vast majority of websites across the world. When the organization behind the language and the FBI’s cyber division warned on Wednesday of significant vulnerabilities in the language,
government agencies, corporations and other organizations were sent into a flurry.
The episode also highlights how artificial intelligence is changing the game when it comes to web security.
Here's what to make of the discovery of the vulnerabilities and the fallout.
The official website for PHP and several other organizations and agencies released security advisories Wednesday urging PHP users to patch two critical vulnerabilities or shut down their sites if they couldn’t update them immediately.
The PHP Foundation, which works to provide transparency and accountability with the language, said the vulnerabilities could be exploited and allow bad actors to get unauthenticated access to sites running PHP.
This would mean attackers could control a web server remotely without needing a password, said James Sullivan, director of cyber and tech at the Royal United Services Institute in London. That could allow a hacker to steal data, alter data or use the system as a platform from which to launch other attacks, he said.
PHP powers about 70% of websites globally, so the possible exposure to vulnerability was immense.
The language is free and open-source, which contributes to its prevalence online. PHP is behind the content management systems WordPress and Drupal, which are commonly used by governments for their sites, and MediaWiki, the software that runs Wikipedia.
In accordance with the security advisories issued this week, several websites were taken offline to prevent exposure while they fixed the problem. There has been disruption to some government services and websites, including in the United Kingdom, Finland and Japan.
Some websites may still be down because there are multiple patches available for different types of software, and some organizations may still be waiting to receive them. They also need to be tested to make sure they work.
The vulnerabilities have been known about since at least 2024, according to the PHP Foundation. A security team developed several competing approaches to solutions, but they each had downsides, and it seemed that there wasn't a practical or concrete way attackers could exploit the vulnerabilities, so progress on a fix stalled, the foundation said.
The group took responsibility for not coming up with a fix sooner, saying: “We won’t pretend otherwise: the delay was a structural failure, caused by both the security team’s decision process and its lack of resources.”
Some experts say the discovery of the vulnerability could have been even earlier than 2024.
Artificial intelligence agents helped uncover the vulnerabilities. In a blog post, OpenAI said it had led a coalition of researchers, security providers and others to address vulnerabilities in PHP over the past two months. Researchers at Wiz, a cloud security platform, also said they independently used AI to identify the vulnerabilities.
The accessibility of AI means that many organizations big and small now have more advanced ways to proactively and reactively respond to security threats. But it also means bad actors have more advanced ways to exploit digital weak points, and at great scale.
James Sullivan, of the Royal United Services Institute in London, said the push-and-pull can be worrisome, but he's focused on the positive side.
“We’ve actually seen quite a decent use case here where AI can discover some critical vulnerabilities and then the community can come together to remediate them,” he said.
