Critical security vulnerabilities affecting PHP, a widely used programming language that underpins much of the internet, have prompted urgent warnings and remediation efforts from developers and cybersecurity experts. The vulnerabilities, announced on Wednesday by the PHP Foundation and the FBI’s cyber division, pose risks of unauthorized remote control over affected websites, sparking concerns across government and private sectors worldwide.

PHP, an open-source scripting language integral to roughly 70% of websites globally, forms the backbone of popular platforms such as WordPress, Drupal, and MediaWiki, which powers Wikipedia. According to the PHP Foundation, the discovered flaws could allow attackers to gain unauthenticated access to servers running vulnerable versions of PHP. James Sullivan, director of cyber and technology at London-based Royal United Services Institute, explained that such access would enable hackers to steal or manipulate data, disrupt services, or use compromised servers as launch points for additional cyberattacks.

In response to the advisories, several organizations, including government agencies from the United Kingdom, Finland, and Japan, temporarily took websites offline to prevent exploitation while deploying the necessary patches. The patching process has been complicated by the existence of multiple updates tailored to different software environments, with some still undergoing testing before full deployment. Charl van der Walt, head of security research at Orange Cyberdefense, described these initial responses as “early tremors” that anticipate more widespread disruption as threat actors continue to scan for vulnerable systems.

The PHP Foundation acknowledged the weaknesses had been known internally since at least early 2024. Multiple proposed fixes had been evaluated but faced challenges, delaying timely resolution. The organization admitted to structural shortcomings within its security team and resource constraints that slowed the development and deployment of effective remedies. Some experts suggest the vulnerabilities may have existed even before 2024, although they apparently remained dormant and difficult to exploit until recently.

The role of artificial intelligence has been notable in both uncovering and addressing the PHP security flaws. Researchers from OpenAI led a collaborative effort involving several security groups over two months to analyze and mitigate the issues, while the cloud security company Wiz also independently employed AI tools to identify the vulnerabilities. This development illustrates a broader trend in cybersecurity where AI is used to both detect threats and assist in crafting solutions. However, experts caution that the same technological advances also empower malicious actors with faster and more sophisticated methods to exploit weaknesses.

Van der Walt emphasized the ongoing challenge defenders face in rapidly replacing vulnerable components with tested and reliable alternatives. Sullivan voiced cautious optimism about the situation, highlighting how AI-assisted discovery has facilitated community cooperation in patching critical vulnerabilities.

The incident underscores the complex and evolving nature of internet security in an era where foundational technologies remain vulnerable and the pace of cyber threat innovation continues to accelerate.