PHP security flaws force government websites offline worldwide

Governments and companies around the world took websites offline on Wednesday after two critical security flaws were found in PHP, the programming language that runs a large share of the internet.

PHP volunteers released an emergency fix the same day. Security agencies in Europe, Britain, Australia and Japan told users to update immediately or take vulnerable systems offline until they can be patched.

The flaws matter to ordinary Nigerians because PHP sits underneath popular website platforms such as WordPress, Drupal, Joomla and Magento. That covers many online stores, news sites, school portals and government service pages. According to the web technology tracker W3Techs, PHP powers roughly 75% of websites whose programming language can be identified.

What was found, and how

The weaknesses were reported privately in August by security firm Calif and by OpenAI, which flagged them independently on the same day, according to Arise News. Google-owned security company Wiz later found more ways to exploit them. The details were kept confidential while a fix was prepared, but leaked online on Tuesday, a day before the planned release.

Wiz said artificial intelligence helped researchers find flaws that had been hidden in PHP's code for more than a decade. The company said exploiting them would once have needed exceptionally complex manual work. "Pre-AI, this manual work would be difficult to implement and even harder to scale," Wiz said. "With AI this is no longer a barrier."

The US National Security Agency warned that the flaws "often provide a direct path to the server's file system or database," and said attackers could use them to take over web servers without a password. The PHP Foundation, which funds developers working on the language, urged users to act: "If you run PHP, it is imperative that you update now."

Tiffany Farriss, interim chief executive of the Drupal Association, said the problem reaches far back. "All servers using any version of PHP released in the last 20 years will be vulnerable," she said. "This issue impacts the majority of the Internet."

Who went offline

In France, local government sites including the Paris Police Prefecture were inaccessible at the request of the national cybersecurity agency, the Interior Ministry said. The Netherlands took its national digital identity service DigiD, the House of Representatives website and the national cybersecurity centre's site offline as a precaution, Dutch broadcaster NOS reported. Belgium's foreign ministry also pulled its sites temporarily, though the country's cybersecurity centre said it had recorded no attacks.

Denmark's municipal IT company Kombit shut several services, including the national school communication platform. Finland's state IT provider Valtori took government public network services offline. Japan's prime minister, Sanae Takaichi, advised site operators to check whether their live sites use PHP. Wikipedia's operator also reported taking some systems offline until they could be safely patched.

Experts say smaller websites are most exposed, especially those run by individuals and organisations with limited technical resources. Many rely on shared hosting and do not control the servers their sites run on, which can delay updates even after fixes exist.

Costin Raiu, co-founder of cybersecurity firm TLP, warned the next stage could be the mass compromise of vulnerable web servers. Lukasz Olejnik of King's College London said the scale is huge and that with AI, exploitation may happen instantly.

What happens next: With the fixes now public, attackers can study them to target sites that have not updated. Website owners should ask their hosts whether PHP has been patched, and update their platforms and plugins.