Global Hacking Alert Over PHP Security Flaw... U.S. Says "Take It Offline if You Can't Update"

Used by 70% of websites worldwide
AI-discovered critical flaw prompts
U.S. and European public agencies to take websites offline as a precaution

A critical security vulnerability has been discovered in PHP, a programming language used by 70% of websites worldwide, triggering heightened hacking alerts across countries. In Europe, access to government agencies and major public services was also repeatedly shut down. The vulnerability was discovered using artificial intelligence (AI), raising concerns that future technological advances could instead increase the risk of cyberattacks.

According to The Wall Street Journal (WSJ) on the 21st (local time), the U.S. National Security Agency (NSA) said in a post on X (formerly Twitter) that day, "We recommend that all organizations and businesses using PHP in their systems prepare to update." It urged them to take the affected systems offline until the vulnerability is fully resolved if an immediate update is not possible.

A person works on a laptop at a cafe in London, United Kingdom, on the 21st (local time). Government websites across Europe were inaccessible after a security flaw was discovered in PHP, one of the web's most widely used programming languages. London, United Kingdom = Reuters-Yonhap News.

The U.S. Federal Bureau of Investigation (FBI) also warned that the risk of sensitive data and networks being compromised had increased, and urged operators to take their websites offline if they could not update them immediately.

PHP is a programming language used to develop websites and powers 70% of all websites worldwide, including popular platforms such as WordPress and Wikipedia. The incident began when a critical security vulnerability known as "PHP2Shell" was discovered in PHP. The flaw stems from the way PHP handles memory and reportedly allows hackers to take control of servers or steal sensitive information without any separate authentication. The Common Vulnerability Scoring System (CVSS) rated it 9.2 out of 10, placing it in the highest severity category, "Critical."

The flaw was discovered using AI. Cybersecurity company Calyp found it using OpenAI's "GPT-5.6 Sol," while Google-affiliated cybersecurity company Wiz independently discovered the issue. The WSJ reported that the vulnerability could have an impact comparable to the "Heartbleed" incident, which posed a large-scale security threat to the global internet in 2014.

PHP's developers brought forward the release of the security patch by one day, from its original scheduled date of the 22nd. However, concerns are growing that the damage could spread, as information about the vulnerability was leaked in advance and some hacking attempts have been observed.

Across Europe, websites were repeatedly taken offline as a precaution. In the Netherlands, services were suspended on government portal websites, the Port of Rotterdam, the football association, major political parties' websites, and hospital websites. The Finnish government also temporarily suspended public network services, while Belgium's Foreign Ministry and local governments, as well as public school communication platforms in Denmark, temporarily blocked access. Some government websites in Germany, France, and the Czech Republic were also taken offline as a precaution.

This content was produced with the assistance of AI translation services.