Critical PHP security vulnerability issues have been discovered in the widely used programming language PHP across global websites, prompting the immediate release of emergency security patches. Amidst reports of initial hacking attempts, government agencies in countries like the Netherlands and Finland temporarily suspended website operations as a precautionary measure.
According to the Wall Street Journal (WSJ) and Reuters on the 21st (local time), PHP developers urgently released a new version fixing two security vulnerabilities. These flaws could potentially be exploited by attackers to remotely execute arbitrary code or take control of systems without requiring separate login or authentication procedures.
W3Techs, a web technology analysis firm, reports that approximately 75% of websites with identifiable programming languages utilize PHP. Furthermore, WordPressβthe website creation and management system utilized by about 43% of all websitesβoperates on a PHP foundation.
Artificial intelligence played a decisive role in uncovering these vulnerabilities, which had remained hidden for over a decade. Cybersecurity firm Califf utilized OpenAI’s ‘GPT-5.6 Sol’ to detect the flaws, while Google-affiliated cybersecurity firm Wiz independently discovered and reported two vulnerabilities. Although these defects were previously noted as potential issues, they were widely considered too difficult to exploit in actual attacks.
Amir Lutwak, co-founder of Wiz, evaluated that this is the most severe security vulnerability ever discovered by AI, noting that it would have been overly complex to find without artificial intelligence. OpenAI also stated that considering the severity of the flaws and the widespread use of PHP, they evaluate this as one of the most impactful security vulnerabilities in recent times.
PHP developers originally planned to release the security patch on the 22nd, but advanced the distribution by a day after related information was leaked on an online forum on the 20th. However, reports indicate that some hackers attempted exploits leveraging the vulnerabilities even before the patch was distributed.
Dane Knecht, Chief Technology Officer (CTO) at web and cloud security firm Cloudflare, stated that initial attack attempts are appearing and that response measures are being continuously updated as new attack paths are discovered. Cybersecurity authorities in Europe, Japan, and Australia have strongly recommended emergency updates.
