Critical PHP Flaws Prompt Emergency Patches and Widespread Site Shutdowns

Overview

• Researchers at Calif and OpenAI privately reported two remote takeover vulnerabilities in PHP in August, and additional analysis by Wiz expanded exploit paths.
• The vulnerability details leaked online before the planned disclosure, and PHP maintainers issued emergency updates on Wednesday that security agencies urged organizations to apply immediately or take services offline.
• Governments and major platforms temporarily suspended public-facing sites and services to apply fixes, with examples including Wikipedia, BBC, national portals in France and the Netherlands, and Brazilian systems such as SEI under Anatel and several regional federal courts.
• Cloud providers and vendors reported active scanning and isolated exploitation attempts, with Amazon and Cloudflare detecting probes that increased the urgency of patching exposed servers.
• Security teams say the episode shows AI can both speed finding deep, long-lived bugs and help attackers craft exploits, creating a need for faster patching, clearer inventories of PHP dependencies, and higher-priority IT governance.