Inc42 reports that two critical vulnerabilities in PHP, the open-source language underpinning much of the modern web, have triggered emergency responses from governments and enterprises worldwide. The flaws allow unauthenticated attackers to execute arbitrary code on host servers. Rated 9.2 on the Common Vulnerability Scoring System, the bugs are believed to have existed in every version of PHP since 2004, exposing a vast portion of the internet to potential compromise.
The discovery process involved OpenAI’s GPT-5.6 Sol model identifying one critical flaw, while Google’s cybersecurity unit, Wiz, independently discovered and reported both issues. Although a multi-month remediation timeline was initially planned, the process was accelerated after proof-of-concept details leaked on technical forums. This forced PHP core maintainers to release emergency builds ahead of schedule. The recommended fix for most organisations is to upgrade to the latest version, PHP 8.5.12, as older versions are no longer fully supported.
The global response has been extensive. According to Inc42, Finland has shut down state internet services, while the Netherlands and France have temporarily taken certain websites offline. In the United States, the National Security Agency advised organisations to update systems or take them offline. In Japan, Prime Minister Sanae Takaichi urged users to check if their public websites run on PHP. The Wikimedia Foundation, which operates Wikipedia, also addressed the vulnerabilities, causing some access issues for users on Thursday.
In India, the Computer Emergency Response Team (CERT-In) issued an advisory flagging a high risk of remote code execution. The agency noted that the flaws stem from memory corruption and improper resource control. Inc42 highlights that India’s exposure is substantial due to the widespread use of PHP in government portals, educational institutions, and e-commerce platforms. Several major Indian services, including Airtel, Jio, and the State Bank of India, experienced issues as reported by website tracker DownDetector. Organisations are advised to restrict public access and monitor logs if immediate patching is not possible.
The episode underscores the changing dynamics of cybersecurity in the AI era. OpenAI described the event as a significant security issue, noting that AI now helps uncover flaws hidden in widely used software. However, the same capabilities that aid defenders may also help attackers develop exploits faster. For organisations, this shift necessitates a move from periodic security reviews to continuous monitoring and rapid patching processes to maintain resilience against future threats.