Used by 70% of Websites Worldwide... PHP Security Flaw Triggers Global Hacking Alert

U.S. National Security Agency: "If immediate updates are not possible, take systems offline"
European countries also suspend website operations one after another

A critical security vulnerability has been discovered in PHP, a programming language used by 70% of websites worldwide, triggering a global hacking alert. As the U.S. government urges immediate security updates, the fallout is spreading in Europe, where websites operated by government agencies and major public services have been taken offline one after another. The vulnerability was discovered using artificial intelligence (AI), prompting concerns that technological advances could instead increase the risk of cyberattacks.

According to The Wall Street Journal (WSJ) on October 21 (local time), the U.S. National Security Agency (NSA) said that day on X (formerly Twitter), “We recommend that all organizations and companies using PHP in their systems prepare to apply a security update.” It also urged them to take the affected systems offline until the vulnerability is fully resolved if an immediate update is not possible. The Federal Bureau of Investigation (FBI) also warned that hackers may be increasingly able to exploit PHP security flaws to remotely infiltrate servers.

A hard drive installed in a computer server in Berlin, Germany, on the 21st (local time). Cybersecurity agencies said websites could become inaccessible while PHP prepares a security patch. Berlin, Germany = Reuters-Yonhap News.

In Europe, websites were taken offline one after another as a precaution. In the Netherlands, services were suspended on websites including government portals, the Port of Rotterdam, the national football association, major political parties, and hospitals. The Finnish government also temporarily suspended public network services, while Belgium’s Ministry of Foreign Affairs and local governments, as well as a communications platform used by public schools in Denmark, blocked access. Some government websites in Germany, France, and the Czech Republic were also taken offline as a precaution.

Industry players have also emphasized the severity of the vulnerability. OpenAI said in a statement that day, “Given the severity of this flaw and PHP’s widespread use, we consider it one of the most impactful security vulnerabilities in recent years.”

PHP is a free, open-source programming language widely used to run websites. When a user visits a webpage, PHP assembles the content on the server and displays it on the screen. According to IT analytics firm W3Techs, about 70% of websites worldwide run on PHP.

Two vulnerabilities were discovered, and the cybersecurity industry has dubbed them “PHP2Shell.” They stem from the way servers handle memory and allow hackers to access a server and execute arbitrary commands without a separate login or authentication process. Reuters reported that a successful attack could lead to personal information being stolen or a server being taken over. Both flaws even scored 9.2 out of 10 under the Common Vulnerability Scoring System (CVSS), placing them in the highest “Critical” severity category.

WSJ reported that one notable aspect of the flaws is that they were discovered during AI research. Cybersecurity firm Kalif used OpenAI’s “GPT-5.6 Sol” to report the first vulnerability on August 11. Google-owned cybersecurity firm Wiz also used AI to report the second vulnerability on August 24. The flaws are believed to have existed for some time but remained undiscovered because their exploitability was difficult to demonstrate.

PHP developers consequently moved up the release of a security patch by one day from its originally scheduled date of October 22. However, concerns about further damage are growing after related information was leaked in advance and some hacking attempts were observed. Kalif CEO Tai Duong told WSJ, “Someone could use AI to analyze the security patch and release code for a hacking attack. If that happens, the resulting chaos could spiral out of control.”

This content was produced with the assistance of AI translation services.