Inside Critical PHP Vulnerabilities That Have 70% Of The Internet At Risk

A pair of critical vulnerabilities in PHP, the open-source programming language that powers much of the modern web, has forced governments and companies across the globe into emergency action. 

The vulnerabilities, identified as part of OpenAI’s “Patch the Planet” initiative and flagged separately by Google’s cybersecurity wing Wiz, could potentially give attackers a direct path to a server’s file system or database. 

For an internet ecosystem built largely on top of open-source components, this is a code-red scenario. The vulnerabilities were flagged by AI, and a fix was issued on Wednesday afternoon.

The response has been unusually broad. Finland has shut down state internet services, while the Netherlands’ cybersecurity agency has taken its website offline. France, too, has temporarily taken certain websites down. 

India’s CERT-In (Computer Emergency Response Team) and the US National Security Agency (NSA) have also advised organisations using PHP to update their systems or take their affected systems offline until immediate patching is not possible. Japanese Prime Minister (PM) Sanae Takaichi, in a post on X, urged people to check if their publicly available websites ran on PHP.

The Wikimedia Foundation, which runs the online encyclopedia Wikipedia, said it was addressing the security vulnerabilities. This led to some users experiencing issues accessing the website on Thursday. 

The episode is significant not only because of the severity of the flaws but also because of how they were found. OpenAI said its GPT-5.6 Sol model identified one critical flaw, while Wiz independently discovered and reported both vulnerabilities. 

OpenAI described the episode as “one of the most impactful security issues in recent memory”, arguing that the development demonstrates both the defensive potential of AI and the growing risk that the same capabilities could help attackers develop exploits faster.

For organisations running PHP-based websites, applications and APIs, the immediate priority is to identify exposure, apply vendor patches and assess whether systems may already have been compromised. The wider tech industry is also rushing to coordinate and mitigate any problems emerging from the fracas. 

So how did the two flaws, which affect nearly every website on the internet, suddenly come to light? 

More Than Half Of Internet At Stake

PHP is a server-side programming language that is used to build websites and web apps. It processes user requests, connects to databases and often controls access to sensitive backend systems. Because it sits between the public internet and an organisation’s data, a flaw in PHP can have consequences far beyond a single website.

The newly disclosed vulnerabilities could allow attackers to reach a server’s file system or database. In practice, that means an attacker may be able to read, modify or delete files, access stored credentials, extract customer data or move deeper into an enterprise infrastructure.

At the heart of the crisis are two interconnected flaws rated 9.2 on the Common Vulnerability Scoring System (CVSS) severity scale.

The bugs exploit deep memory-handling mechanisms inside the PHP execution core. This allows unauthenticated external attackers to send crafted web traffic, bypass security checks, and execute arbitrary code directly on the host server.

Making matters worse, these flaws aren’t restricted to modern builds. These vulnerabilities are believed to have existed in every version of PHP since version 5, which was first released in 2004. 

Websites running older versions face a more difficult upgrade path, as PHP 8.1 and earlier are no longer supported. The recommended fix is to move web servers to the latest version, PHP 8.5.12.

While the vulnerabilities were originally discovered by a joint team involving Google and OpenAI, the planned multi-month remediation timeline had to be rushed. After proof-of-concept details leaked prematurely on technical forums like Hacker News, PHP core maintainers were forced to rush out emergency builds ahead of the schedule.

“With 70% of the Internet affected, the impact of PHP2Shell cannot be overstated. It marks an AI inflexion point,” said Google Wiz in a post.

India Braces For Impact

India’s exposure is likely to be substantial because PHP remains widely used across government portals, educational institutions, small businesses, ecommerce platforms and legacy enterprise systems.

Many Indian organisations also rely on shared hosting providers, third-party web developers and older PHP-based content management systems. In these environments, the organisation using the website may not directly control the PHP version or patching cycle. As such, this could create a dependency on hosting providers and managed-service vendors to apply updates quickly.

The government’s own digital footprint could also be impacted. Many public-facing portals and state-run services often depend on PHP-based stacks. A vulnerability that potentially allows access to databases could also raise major concerns among the general populace.

The effect is already visible. As per website tracker DownDetector, websites like Airtel, Duolingo, Jio, Bank of Baroda, IRCTC, and State Bank of India, among others have been facing issues in the past few hours. 

As a result, CERT-In has issued an advisory for all “organisations and individuals using PHP. The agency has flagged “high risk of remote code execution and complete system compromise” due to these vulnerabilities. 

“These vulnerabilities exist in PHP due to memory corruption and improper resource control. A remote attacker could exploit these vulnerabilities by sending a specially crafted request to the targeted system. Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code and compromise affected systems on the targeted system,” said CERT-In.

Going forward, Indian startups and companies will have the job of quickly identifying every PHP-based website and API in use. They will then have to apply the official patch as soon as it is available.

Where immediate patching is not possible, organisations should restrict public access, place affected systems behind a web application firewall, monitor logs for suspicious activity and consider temporary isolation. They should also review backups and recovery plans in case compromise is detected.

How Bad Is It?

The immediate operational impact could be disruption. Enterprises that cannot immediately patch vulnerable PHP systems could potentially have to take their systems offline until mitigation processes are complete.

For businesses, this can mean suspended websites, unavailable customer portals, delayed transactions and interrupted internal tools. For public-sector bodies, the risk extends to citizen services, government communications and critical administrative systems.

The government actions illustrate the scale of concern. As mentioned above, various bodies in Finland, the Netherlands and France have taken various websites down as a precautionary measure. 

The security consequences could be more damaging. If cyber attackers gain access to a server’s file system or database, they can potentially steal personal data, business records, authentication credentials or payment information. They could also modify website content, install persistent access tools or use compromised servers as a base for further attacks.

Cyberattacks In The AI Age

The PHP vulnerabilities show how quickly security has changed in the AI era. AI can now help researchers uncover flaws hidden in widely used software, giving defenders a chance to prepare fixes before attackers exploit them. 

At the same time, agentic AI has accelerated vulnerability discovery and exploit development just as easily as it can support patching and threat detection. As models become more capable, the gap between a flaw being found and an attack being launched may shrink dramatically. 

This puts pressure on organisations to move from periodic security reviews to continuous monitoring, rapid patching and stronger default protections.

For organisations, the lesson is clear. Security can no longer be treated as an annual compliance exercise. Companies will need fast patching processes, least-privilege access controls, robust backups and incident-response plans. They must also assume that attackers may use AI to find and exploit weaknesses faster than before.

The PHP episode may be remembered less for the vulnerability itself than for what it signals. AI is becoming a central force in both offensive and defensive cybersecurity. The advantage will belong to organisations that use it to find, fix and prevent problems before adversaries can act.

The post Inside Critical PHP Vulnerabilities That Have 70% Of The Internet At Risk appeared first on Inc42 Media.