Global Websites Offline After Massive PHP Security Flaw

It was not a routine patch Tuesday. This was an emergency of rare vintage. International cyber-security agencies rushed to issue urgent advisories, warning that if organizations could not immediately apply the newly released fixes, they had a singular, radical option left: go dark.

The Ghost in the Machine

PHP is the digital plumbing of the modern internet. It quietly powers millions of content management systems, e-commerce checkouts, custom web applications, and hosting control panels. Often, organizations do not even realize it is running beneath their bespoke architectures. When a vulnerability strikes this deep into the stack, the fallout is rarely localized.

The scale of the threat became clear after details leaked prematurely on social media, forcing the PHP Foundation to accelerate its disclosure timeline. CERT-EU warned that the risk scores attached to these vulnerabilities pointed squarely toward the potential for unauthenticated remote code execution—the holy grail for malicious actors seeking to install malware or compromise core infrastructure.

“Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated.” — UK National Cyber Security Centre (NCSC)

Listening to that guidance, governments and public bodies didn’t hesitate. Finland temporarily shut down key public web services. The Netherlands followed suit, cutting access to the Tweede Kamer and public health agency portals. In the United States, the NSA urged system administrators via social channels to isolate vulnerable setups immediately.

When Wikipedia and the BBC Blink

The disruption quickly bled into everyday consumer touchpoints. The Wikimedia Foundation confirmed it had proactively yanked a number of internal and external systems offline, leaving some users intermittently locked out of parts of Wikipedia. Across the UK, Edinburgh council’s web domain vanished, while online homes for popular BBC programmes like Doctor Who and The Traitors dropped out of reach.

Down the line, platforms like DeviantArt slipped behind maintenance screens, though many organizations kept tight-lipped about the exact trigger. The problem wasn’t merely downloading a file; it was mapping out where PHP lived across sprawling corporate ecosystems.

“The use of PHP is pervasive, it can sit beneath public websites, content management systems, hosting platforms and third-party products, sometimes without even being obvious to the organisation using it,” explains Don Smith from the Sophos Counter Threat Unit.

How Artificial Intelligence Rewrote the Rules

What makes this specific incident a watershed moment for the tech industry isn’t just the damage—it is how the flaws were found. The vulnerabilities had lurked inside the PHP source code for more than a decade, completely undetected by human developers, automated code scanners, and traditional penetration testers.

That changed through Patch the Planet, an OpenAI-backed program designed to give select security researchers access to frontier artificial intelligence models. Security firms Calif and Wiz deployed advanced AI agents to interrogate the legacy codebase. Within weeks, the models mapped out complex, working exploits across multiple applications.

“Frontier models were critical to making this process practical, enabling us to develop and adapt working exploits across multiple applications in hours,” Wiz noted in a technical post-mortem.

OpenAI characterized the discovery as one of the most impactful security events in recent memory. It underscores a terrifying new industry paradigm: artificial intelligence is now sophisticated enough to uncover zero-day vulnerabilities in foundational software faster than human engineers can audit them.

The Global Patching Struggle

As the dust begins to settle, system administrators face a grueling remediation marathon. The PHP Foundation released patches targeting modern iterations, but users running older versions—dating all the way back to PHP 5 launched in 2004—face heavy infrastructure upgrades.

Meanwhile, infrastructure heavyweights like Cloudflare reported early waves of automated scanning and attacks hitting their edge networks as malicious actors raced to weaponize the leaked exploits before patches could be blanketed across the web.

The takeaway for enterprise engineering teams is unequivocal. Security through obscurity is dead. When artificial intelligence can dissect legacy software repositories in hours, the window between vulnerability discovery and systemic exploitation has shrunk to zero. Organizations must treat their software supply chains with ruthless paranoia, ensuring that every hidden instance of legacy code is cataloged, monitored, and immediately updated.