Explained: What is PHP and why did it take government websites offline?

On Wednesday, government websites across Europe experienced outages as administrators worked to fix two critical vulnerabilities in PHP, a popular web programming language. The developers announced they would release patches to address the flaws. European cybersecurity officials advised organizations unable to apply the patches to take affected websites offline to prevent potential exploitation.

PHP, a free, open-source language, runs nearly 70% of the world's websites, powering platforms like WordPress used by blogs, small businesses, and government portals. It is the engine behind much of the online presence seen today. The vulnerabilities rated extremely severe on the CVSS v4.0 scale, indicating unauthenticated remote code execution. This means attackers can run commands on vulnerable servers over the internet without needing passwords or accounts.

Once exploited, attackers could gain control of the website, leading to data theft, defaced pages, or even full system compromise. Web hosting provider GoDaddy highlighted the potential for stolen data, defaced pages, or complete system takeover. Cloudflare's chief technology officer reported early signs of attacks exploiting the flaws.

The vulnerabilities were discovered in August by researchers from Calif and Wiz, using advanced AI models. Wiz called the findings among the most severe PHP vulnerabilities ever discovered, noting they had been present for decades. Despite their severity, proving they were exploitable required a challenging chain of steps beyond what human researchers could typically achieve.

US officials said they were tracking the situation closely, emphasizing the importance of these findings for national security, framing the discovery as evidence that advanced AI technologies strengthen security.