A critical vulnerability in PHP, the programming language that underpins more than 70% of the world's websites, has triggered a global security response, with multiple European governments and the Port of Rotterdam taking websites offline and cyber agencies in Australia, the US, the UK, Europe and Japan urging developers to apply urgent patches.
The flaw was discovered in August by researchers at security firm Wiz, who used their own tools and the latest versions of Google's Gemini and OpenAI's ChatGPT AI models to search PHP's codebase for weaknesses an attacker could chain together. Within days they found ways to break into PHP-powered systems running Drupal and WordPress, and alerted the PHP security team. By late September the developers had confirmed the issue and quietly begun working on a fix.
In cybersecurity, the responsible thing to do when a bug is found is to keep it private until a patch is ready, and that appears to have been the plan. But a user on the industry forum Hacker News disclosed the flaws before patches were ready, prompting PHP's developers to rush out a public confirmation and emergency updates ahead of schedule.
PHP is a server-side programming language that has been around since 1997, often described as "the backbone of the web". It handles user logins, online stores, database requests and blog posts, running on servers rather than personal devices, so most people interact with it daily without seeing it.
Applying the fixes will take time. PHP sits underneath thousands of third-party plugins, frameworks and managed hosting services, and a website is only secure once every layer of that supply chain has integrated and deployed the update. The organisation behind the open-source language has published patches, but millions of systems still need to run them.
The Australian Signals Directorate, America's Cyber Defence Agency and counterpart bodies in the UK, Europe and Japan have all told developers to apply urgent updates and to consider taking down websites until safety can be guaranteed. The Port of Rotterdam and a number of European governments have already taken sites offline.
For everyday users, the vulnerability affects the servers hosting websites rather than personal devices. The analysis advises caution when entering sensitive personal data on unfamiliar websites over the next few days, since some sites may be temporarily compromised before they patch. Major cloud providers and security firms are rolling out emergency filters.
The episode reflects a broader problem, argues the piece's author, Andrew Cullen, a guest research fellow at the University of Melbourne. Much of the internet runs on foundational technologies built and maintained by hobbyist developers; many rely on goodwill and donations rather than robust corporate funding, and maintenance is rarely a priority for organisations. He says businesses and governments should map the software they depend on and treat funding for open-source foundations as a critical security investment rather than a charity.
Analysis
Why This Matters
- PHP powers more than 70% of websites, so a successfully exploited flaw could compromise millions of sites and the data held on their servers.
- Patches exist but must travel through a long chain of plugins, frameworks and hosts, leaving many sites exposed for days.
- The incident is a live test of how well industry and governments respond to vulnerabilities in volunteer-maintained open-source foundations.
Background
PHP is a free, open-source server-side scripting language that has powered websites since the late 1990s. Like much of the internet's foundational software, it is developed and maintained largely by volunteers and donations, a model that security researchers say leaves critical infrastructure underfunded and hard to secure. The language underpins widely used platforms including WordPress and Drupal.
Key Perspectives
Wiz researchers: found the flaws through an AI-assisted review of PHP's codebase and reported them privately to the PHP security team before any public disclosure.
PHP developers: confirmed the issue by late September, began work on a fix, and released emergency patches ahead of schedule after details leaked on Hacker News.
Cyber agencies in Australia, the US, the UK, Europe and Japan: warn developers to apply urgent updates and consider taking websites offline until safety can be guaranteed.
Andrew Cullen (University of Melbourne): argues the episode should be a wake-up call, and that businesses and governments should map their digital supply chains and treat funding for open-source foundations as a security investment rather than a charity.
What to Watch
- How quickly hosting providers, plugin developers and site operators deploy the emergency patches across the supply chain.
- Whether attackers begin exploiting unpatched systems as technical details of the flaw spread.
- Whether the incident prompts new government or industry funding and oversight for foundational open-source software.
Checked
12 claims in this story checked against 1 source: 12 supported.
Show each claim
- SupportedThe critical PHP flaw puts about 70% of websites at risk, and agencies are urging patches.Startup Daily: “A critical flaw affecting 70% of all websites ... The Australian Signals Directorate, America’s Cyber Defence Agency, and similar bodies from the United Kingdom, Europe and Japan have all warned web developers to apply urgent updates”
- SupportedMultiple European governments and the Port of Rotterdam have taken websites offline as patches have been published.Startup Daily: “In response, multiple European governments and operators including the Port of Rotterdam have taken websites offline. ... The organisation behind the free, open-source language has published updates that patch the flaw”
- SupportedThe Australian, US, UK, European and Japanese cyber agencies urged developers to apply urgent updates.Startup Daily: “The Australian Signals Directorate, America’s Cyber Defence Agency, and similar bodies from the United Kingdom, Europe and Japan have all warned web developers to apply urgent updates”
- SupportedWiz researchers discovered the flaw in August using their tools and the latest versions of Gemini and ChatGPT to search PHP’s codebase.Startup Daily: “In August, a cybersecurity researchers from a company called Wiz used their own tools and the latest versions of Google’s Gemini and OpenAI’s ChatGPT AI models to trawl through PHP’s massive codebase.”
- SupportedWithin a few days, the researchers found ways to break into PHP-powered systems using Drupal and WordPress.Startup Daily: “Within a few days, they found ways to break into PHP-powered systems from Drupal and WordPress”
- SupportedWiz alerted the PHP security team about the flaws.Startup Daily: “Wiz contacted the PHP security team to let them know about the flaws they had found.”
- SupportedBy late September, PHP developers had confirmed the issue and quietly started working on a fix.Startup Daily: “By late September, the PHP developers confirmed that the issue existed, and quietly began working on a fix.”
- SupportedA Hacker News user disclosed the flaws before patches were ready, prompting PHP developers to confirm the issue publicly and release emergency patches ahead of schedule.Startup Daily: “Following the leak, PHP’s developers rushed to publicly confirm the issue on October 21, releasing emergency patches ahead of schedule.”
- SupportedPHP is often described as “the backbone of the web”.Startup Daily: “PHP is often called “the backbone of the web”.”
- SupportedApplying the PHP fixes will take time because websites depend on layers of plugins, frameworks and managed hosting services that must integrate and deploy the fix.Startup Daily: “Because PHP sits underneath thousands of third-party plugins, frameworks and managed hosting services, websites are only secure once every individual layer of the supply chain integrates and deploys the PHP fix.”
- SupportedThe source advises everyday users to be cautious about entering sensitive personal data on unfamiliar websites because some may be compromised before patching.Startup Daily: “because some sites may be temporarily compromised before they can patch, it is wise to be cautious about entering sensitive personal data on unfamiliar websites over the next few days.”
- SupportedAndrew Cullen argues that businesses and governments should map the software they depend on and treat funding for open-source foundations as a critical security investment, not charity.Startup Daily: “Governments and businesses cannot ignore the resilience of their digital supply chains. ... Until businesses treat funding open-source foundational tools as a critical security investment rather than a charity”
