Severe vulnerability in PHP causes millions of attacks and could affect up to 70% of all websites on the internet in the world

Vulnerability in PHP could affect up to 70% of websites October 22, 2026After the developer of the programming language PHP released the cybersecurity patch 8.5.12, in order to prevent malicious attacks by cybercriminals due to a serious flaw in that resource, governments and companies worked all night on urgent security updates. The discovery of serious vulnerabilities in a programming language fundamental to 70% of websites worldwide was assisted by artificial intelligence. Although many government websites appeared to be functioning normally this Thursday, interruptions or service limitations persisted while security work was being carried out. As companies and governments implemented patches and suspended websites as a precaution, attempts at cyber piracy skyrocketed to reach millions, according to the cloud services firm Cloudflare. "In the 10 hours preceding the public announcement, we observed thousands of attempts to exploit it across our entire network," said Matthew Prince, CEO of Cloudflare, in a post on X late Wednesday. "The number increased to tens of thousands in the 45 minutes following the announcement, to hundreds of thousands within 2 hours, and now it is in the millions." The FBI's cyber division warned on Wednesday that these vulnerabilities could allow malicious actors to execute code remotely in PHP, the programming language that underpins websites and web applications. According to the agency, this increases the risk of confidential data and networks being compromised; therefore, it recommended that administrators disconnect websites if they cannot update them immediately. In the United Kingdom, the Prime Minister's office reported that some government services "limited" could remain disconnected temporarily while work was done to resolve possible cybersecurity problems. "Work has been carried out throughout the Government to identify and correct possible vulnerabilities in our systems; our experts continue working in close collaboration with OpenAI and international partners to address this matter," said a spokeswoman this Thursday. Offline Services The spokeswoman added that although no critical, large-scale public services have been affected, some limited services might be temporarily offline while security tasks are being executed. James Sullivan, Director of Cybersecurity and Technology at the Royal United Services Institute in London, explained that the two critical flaws detected by artificial intelligence could allow malicious actors to gain unauthorized access to websites; in theory, this would give them the ability to remotely control a web server without needing a password. According to Sullivan, this could allow an attacker to steal or alter data, or use the system as a platform to launch other attacks. Sullivan described the disconnection of websites during the resolution of the problem as a "best practice" and proper management of cyber risk; however, he noted that it is "amazing" that some of these flaws are more than a decade old. The Two Sides of the PHP Flaw The discovery of these vulnerabilities was possible thanks to artificial intelligence agents. In a post on their blog, OpenAI reported that over the last two months, it has led a coalition composed of researchers, security providers, and other actors to address the vulnerabilities in PHP. OpenAI described these flaws as "one of the most impactful security problems recently remembered." It was indicated that the AI seemed to have detected the vulnerabilities before any attacker. "This has its good side and its bad side," Sullivan noted, explaining that although the AI can help attackers identify new vulnerabilities, it can also be used to discover and correct them. According to him, the reason some websites might still not be working is that there are multiple patches available for different types of software; it is possible that some organizations are still waiting to receive them and, furthermore, these must undergo testing to ensure their correct functioning. Japan and Finland Also React The website of the Finnish government reported that the interruption had already been resolved, although it added that "part of the content is still missing, which is currently being restored." In Japan, the Osaka prefectural website indicated that its automatic translation service was not available "due to a system failure." The Japanese government issued a warning through a social media post, advising website administrators to check if they use PHP and to immediately install a patch that was published on Wednesday night. "If it is difficult to apply the correction patch promptly, the temporary suspension of websites—or other similar measures—can be considered an effective way to reduce the risk," said Sanae Takaichi. The Chief Cabinet Secretary, Minoru Kihara, indicated that the government has not received reports of damage caused by cyberattacks related to this vulnerability in PHP. One of the vulnerabilities corrupts the system's memory—preventing it from retaining certain data—which allows an attacker to exploit the system through their own code. The other flaw causes user data to remain stored in the system instead of being deleted, which could allow a malicious third party to access, download, or even delete it, Sullivan explained. The PHP Foundation, which has developers dedicated to strengthening the security of this programming language, announced on Wednesday afternoon (European time) the publication of corrections for these vulnerabilities, along with instructions on how to update the systems. The European Union Agency for Cybersecurity (ENISA) recommended that organizations "take immediate action" to address these vulnerabilities. Don't let the algorithm hide the news. If you trust this site for reliable information, please take a moment to select us as your preferred source on Google: click here and check the box or press the DW.com button to always see our verified news in your preferences.