Technology

PHP Vulnerabilities Prompt Global Web Outages and Urgent Patches

By Al Jazeera Staff

PHP, the programming language that powers more than 70 percent of websites worldwide, was found to contain two critical flaws that allow attackers to execute code on affected sites and potentially expose personal data. The defects, dubbed PHP2Shell, were discovered by the cybersecurity firms Calif and Wiz with the help of artificial intelligence. Calif first reported a flaw on August 11 and Wiz reported a second on August 24. Both vulnerabilities stem from how PHP handles fatal errors, such as running out of memory, and are rated 9.2 out of 10 on the industry severity scale.

The bugs affect PHP versions 5.4 and later, covering more than a decade of releases. Because PHP runs on the servers that generate web pages, any site using an affected version is vulnerable, even a simple website. The flaws were hidden in the codebase for over ten years and would have been extremely difficult for a human hacker to exploit.

The PHP development team released urgent patches on Wednesday, urging all users to update immediately. The language’s creators said they had coordinated with Calif, Wiz, OpenAI and the PHP team before making the vulnerabilities public.

The discovery triggered widespread outages. In the Netherlands, the Dutch cybersecurity agency shut itself offline as a precaution, and other Dutch sites—including the Port of Rotterdam, the government portal Overheid.nl, the national football association KNVB, the websites of the country’s five largest political parties and several hospital sites—were taken down. Finland’s state IT services provider Valtori also disabled public network services, while France’s Ministry of the Interior placed all its websites into preventive maintenance. Belgium’s Federal Public Service Foreign Affairs temporarily took its sites offline after reports of attacks, though no attacks were recorded.

South Korea’s government raised its private‑sector cybersecurity alert level and issued guidance to roughly 28,000 companies with chief information security officers, 5,900 members of a government information‑sharing network, and operators of critical infrastructure, web‑hosting firms and data centres. The online encyclopedia Wikipedia removed an unspecified number of systems until they could be patched, and the Internet Archive briefly went offline to address the issue.

Security researchers noted that the rapid disclosure of the flaws, combined with the fact that AI is increasingly used to find and exploit vulnerabilities, raises concerns about the potential blast radius of such attacks. The PHP team has responded quickly with patches, but the incident highlights the risk inherent in shared digital infrastructure.