Critical PHP Flaws Trigger Global Emergency and Wide Site Shutdowns

Overview

• The vulnerabilities were privately reported in August by security firm Calif and independently by OpenAI, then leaked online a day before a planned disclosure which turned a controlled fix into an emergency response.
• The U.S. National Security Agency warned organizations to apply the patch immediately or take vulnerable systems offline because the flaws can give direct access to server file systems and databases without a password.
• In what sources reported as Wednesday's global reaction, governments and major services temporarily took sites offline for safety, including local French administration pages and Dutch national services such as DigiD and parliamentary sites.
• PHP maintainers and volunteers released an emergency update on October 21 and the PHP Foundation urged immediate upgrades, while security firm Wiz reported additional exploitation methods that agencies are still assessing.
• The incident shows how advanced AI tools speed vulnerability discovery and may raise the pace of disclosures, increasing pressure on organizations to speed patching and on smaller sites to shore up basic defenses.