Two serious security weaknesses in PHP have prompted emergency updates and temporary website shutdowns. PHP is a programming language that helps power around 70% of the world’s websites. Both flaws received severity scores of 9.2 out of 10. They could allow attackers to run harmful instructions on computers hosting websites, potentially taking control or accessing private information. PHP’s developers released fixes on 21 October.
Artificial intelligence helped researchers uncover the flaws. Calif identified one using OpenAI’s GPT-5.6 Sol, while Wiz independently discovered and reported both. Researchers and developers worked privately to prepare fixes, but information became public before the planned announcement. Attempts to exploit the weaknesses have since been detected, increasing concern about systems that have not been updated.
Government websites in France, Germany, the Netherlands and Finland were temporarily taken offline as a precaution. Germany said it had identified no security incidents. The Wikimedia Foundation, which operates Wikipedia, also paused some supporting services while installing updates. Security authorities urged organisations to update affected systems immediately or disconnect them until they could be secured. The flaws affect website servers rather than users’ personal devices. Security filters can help block attacks, but they do not replace the software updates.
