Massive PHP Security Flaw Knocks Websites Offline Around the World
Websites around the world went dark this week after the discovery of two critical security flaws in PHP, a programming language that powers roughly 70% of the internet, including sites built on WordPress and Drupal.
Governments, banks, airlines and even Wikipedia temporarily took sites and services offline to install emergency fixes. The good news is that so far, no major organization has reported being hacked because of the flaws.
What Happened
The two flaws, nicknamed "PHP2Shell," were found by researchers at OpenAI, Google-owned Wiz and a cybersecurity company called Calif, who used artificial intelligence tools to dig through PHP's code. According to Wiz, the weaknesses "had remained hidden in the PHP codebase for more than a decade," ABC7 New York reported.
Both flaws were rated 9.2 out of 10 for severity. They could let attackers take control of a website without logging in and potentially read sensitive information, such as passwords, stored in a server's memory.
The researchers found the problems in late August and planned to keep them quiet until a fix was ready. But details leaked early, including a video of a working attack that was accidentally posted online on Oct. 20. The PHP team then moved up its release and put out patches on Wednesday, Oct. 21, The Hacker News reported.
The U.S. National Security Agency and Europe's cybersecurity agency urged organizations to act immediately. Wiz researchers compared the situation to Heartbleed, a major 2014 security bug that affected a large share of the web.
Who Went Offline
Government websites in France, Denmark, Finland and the Netherlands were temporarily taken down while fixes were installed. In Japan, the airline ANA, the rail operator JR West and MUFG, the country's largest bank, temporarily suspended some webpages and services.
The Wikimedia Foundation, which runs Wikipedia, said several of its systems were taken down as a "precautionary measure." In the U.K., Downing Street said no large public-facing critical services were affected and stressed that services being offline does not mean they were hacked.
Japanese Prime Minister Sanae Takaichi urged companies to act quickly. "Please check if your publicly available websites use PHP," she wrote on X.
The Dutch National Cyber Security Centre warned that some sites could take a while to return. "Some websites can flip a switch, but for others it may take longer," Deputy Director Corine Schipper-Derkse said, according to NL Times.
Have Any Sites Been Hacked?
So far, there are no confirmed reports of a major breach tied to the flaws. Most of the disruption has come from organizations choosing to shut down sites on their own while they patched.
Hackers are trying, though. Cloudflare CEO Matthew Prince said the company saw thousands of attempts to exploit the flaws in the hours before the fix was announced, and that number has since grown into the millions.
Experts say pulling the plug for a day was the smart move. "Taking a website offline for a day is a far cheaper decision than explaining a breach for a year," said Samuel Hassine, CEO of the cybersecurity company Filigran.
The discovery is also another sign of how quickly AI is changing cybersecurity, for better and for worse. Last month, an OpenAI agent reportedly breached an Australian government health website.
What This Means for You
For most people, there is nothing to install. The fix is for the servers that run websites, not for your phone or computer. "You don't need to install PHP updates on your own device," security company Malwarebytes said.
If a favorite website is down, that alone does not mean it was hacked. It most likely means the site is being updated, and many of the affected sites are already back online.
Still, it is smart to stay alert. Malwarebytes advises watching for odd content, unexpected downloads, strange redirects or repeated login prompts on familiar sites. If a page looks off, close it and do not enter any personal information.
If you run your own website or blog, check with your web host to make sure your site has been updated to the latest version of PHP.
Curious for more stories that keep you informed and entertained? From the latest headlines to everyday insights, YourLifeBuzz has more to explore. Dive into what’s next.