Two critical PHP vulnerabilities threaten websites worldwide. Here’s why Russia, where the language powers more than 90% of sites, faces particularly high risks.

On October 21, the creators of the PHP programming language disclosed the discovery of two critical vulnerabilities. These flaws allow unauthorized remote code execution on servers, potentially giving attackers access to sensitive data, malicious code insertion, website content alteration, traffic redirection, and DDoS attacks or spam campaigns. Over 70% of the world's websites, which utilize PHP, are at risk due to these vulnerabilities.

PHP, an open-source scripting language developed by Rasmus Lerdorf in 1995, remains widely popular, powering more than 90% of websites worldwide. Its simplicity makes it accessible to beginners, but this ease of learning has also resulted in the creation of a significant amount of bad code. Despite criticism for inconsistencies and illogical features, PHP continues to dominate the web development landscape, with major sites like Facebook still utilizing it.

Researchers from two teams independently discovered the vulnerabilities, one utilizing AI models like GPT-5.6 Sol. The PHP development team collaborated with several companies to develop an update, which was released before attackers could exploit it. However, an external security audit had detected signs of one of the vulnerabilities as early as 2024. The vulnerabilities arise from errors in PHP's memory handling, enabling attackers to execute arbitrary code or manipulate data on compromised servers.

The PHP vulnerabilities pose significant security threats, with OpenAI describing them as among the most far-reaching cybersecurity issues in recent years. The impact extends beyond system administrators to website owners, users, and even governmental agencies. Several countries, including Belgium, the UK, Denmark, and France, temporarily took their public websites offline to mitigate potential risks.

Reg.ru, a prominent domain registrar in Russia, also experienced temporary file upload restrictions due to the vulnerabilities. Despite the availability of updates, many system administrators may not promptly install the fixes, leaving numerous websites susceptible to potential attacks.