AI discovers major PHP vulnerability; multiple governments and enterprises suspend online services

PHP is a programming language used to run websites, and because PHP is so widely used, any serious vulnerability can set off a huge chain reaction. Image source: Dado Ruvic/REUTERS

(German Wave Chinese website) The PHP development team released an emergency security update on Wednesday (October 21), fixing serious vulnerabilities that had been hidden in the software for years, and called on all users to upgrade immediately. Cybersecurity companies warn that some hackers have already begun exploiting these vulnerabilities to launch attacks.

PHP was created in the early 1990s. It is a programming language widely used to run websites and is also an important component of website systems such as WordPress, Drupal, Joomla and Magento. Because PHP is so widely used, any serious vulnerability can set off a huge chain reaction.

Tiffany Farris, acting CEO of the Drupal Association, said that every version of PHP released over the past 20 years contains the vulnerability, and called the problem one that "affects the vast majority of websites on the internet."

Cybersecurity agencies around the world have urged PHP users to install the update immediately; until patching is complete, websites should be temporarily shut down where necessary.

Data from internet intelligence company Censys shows that of the 2.6 million hosts reported to be running PHP, about 1.5 million are still using versions for which no fix is available.

Large-scale global service outages

Tencent Cloud, one of China's large cloud computing service providers, urged customers to install the updated PHP version, but did not go further in calling for widespread website shutdowns.

Companies including Japan's Nomura Securities, Mitsubishi UFJ Financial Group, All Nippon Airways and East Japan Railway said on Thursday that as emergency measures they had temporarily suspended some internet services. Japan's Ministry of Finance and Meteorological Agency partially suspended online services to implement security measures; the National Tax Agency also temporarily shut down related services.

Why does this kind of cyberattack pose a serious threat to press freedom?

French telecom group Orange said that as a precaution it had temporarily suspended access to some PHP-based websites and applications of several subsidiaries.

Several European countries and institutions took precautionary measures. The Netherlands' National Cyber Security Centre was temporarily taken offline, and the Port of Rotterdam, the government portal Overheid.nl, the Royal Dutch Football Association, the official websites of the country's five major political parties and the websites of several hospitals were also shut down one after another. The operator of the online encyclopedia Wikipedia said it had shut down some systems and would restore them after security patching was completed.

Danish municipal IT company Kombit shut down multiple services, including the national school communication platform. Finland's national IT service provider Valtori said government public online services had been taken offline "as a precaution." France's Ministry of the Interior placed all government websites into preventive maintenance status.

The Dutch prime minister said he was closely monitoring developments. Japanese Prime Minister Sanae Takaichi also reminded website owners on social platform X to check whether the websites they operate use PHP and to be ready to install the new patch.

Two cybersecurity companies said in separate reports that the PHP vulnerabilities were discovered with the help of artificial intelligence.

Cybersecurity company Calif said it discovered the vulnerabilities on August 1 with the help of a large language model and had since been working on developing a fix.

Wiz, a cybersecurity company owned by Google parent Alphabet, said it used its own AI vulnerability research tool Wiz Atlas, as well as Google's Gemini 4 Argon and OpenAI's GPT-5.6 Sol, to discover the vulnerabilities.

Europe's efforts to build "digital sovereignty"

An "exploit race"

Wiz noted that the vulnerabilities had been hidden in the PHP codebase for more than a decade. In the past, human researchers needed to do a great deal of work to discover and exploit these vulnerabilities; AI has greatly lowered that threshold.

Kostin Reu, co-founder of cybersecurity research and incident response organization TLP:Black, said artificial intelligence is driving an "exploit race," and the next step could be the large-scale compromise of all vulnerable web servers on the internet.

PHP covers a large number of websites and has broad impact

PHP is a programming language used to run websites and is free and open source. When a visitor loads a page, the server running PHP generates the page content and sends it to the browser.

According to data from web technology tracking organization W3Techs, about 75% of websites whose programming language can be identified use PHP. Its widespread use worries cybersecurity experts, especially as hacker attacks carried out with the help of artificial intelligence have continued to increase in recent years.

However, not all PHP websites face the same risk. Automattic, the operator of WordPress.com, said users of its hosting service and Tumblr users will not be affected by this vulnerability. By contrast, small PHP websites run by individuals or organizations with limited technical resources face higher risk. These websites often use shared hosting services, and customers do not directly manage the underlying servers.

Fixing some systems may take weeks

On Thursday (October 22), governments in several Asian countries ordered cybersecurity checks related to the PHP vulnerability.

China's Ministry of Industry and Information Technology urged organizations and users to check their own systems and upgrade to the latest secure version of PHP. The ministry also recommended strengthening cybersecurity monitoring and, where necessary, changing accounts, passwords and keys.

South Korea raised its cybersecurity alert level for the private sector and activated emergency response measures, citing concerns over rising risk of hacker attacks.

Felix Kuhlenkamp, who heads security affairs at the German digital industry association Bitkom, said many larger operators have already completed updates, but for complex IT systems and smaller organizations, fixes may take longer.

"They may run a website that uses PHP but not pay close attention to how it is running," he said.

He added: "If a website is still running on an old version of PHP for which no security updates are available, the entire system must be upgraded."

DW Chinese is on Instagram! Search for dw.chinese to see more in-depth text and video reports.