PHP flaws force websites offline worldwide

Government agencies and companies around the world took websites offline on Wednesday after two critical security flaws were disclosed in PHP, a programming language used across much of the internet.

The US National Security Agency told organisations to patch immediately or take vulnerable systems offline. It said the flaws often provide a direct path to a server’s file system or database, allowing attackers to take over web servers without a password.

PHP volunteers released a fix on Wednesday. The PHP Foundation urged users to update immediately.

Security firm Wiz estimated that PHP runs about 70 percent of the world’s websites and described the flaws as among the most severe vulnerabilities found in PHP. Security engineer Volker Dusch told the Wall Street Journal the issue was PHP’s most serious problem in more than a decade.

Security firm Calif said it found the flaws in August using OpenAI’s GPT-5.6 Sol model during an OpenAI-funded audit of PHP code. Google-owned Wiz said it found them independently weeks later with help from AI models including Google’s Gemini 4 Argon and GPT-5.6 Sol.

Details leaked online Tuesday, one day before the planned release of the fix, prompting a rush to take sites offline.

In France, local government websites, including one for Paris police, were inaccessible at the request of the French National Cybersecurity Agency, the interior ministry said. In the Netherlands, public broadcaster NOS said the DigiD digital identity service, the House of Representatives website and the national cybersecurity centre site went offline as a precaution. Belgium’s foreign ministry said it temporarily took its websites offline, while Australia’s ABC reported that the Australian Signals Directorate’s cyber.gov.au site was among affected government websites.