Flaws in software behind millions of websites lead governments to suspend services - critical summary review

On Wednesday the 21st, people trying to send documents to Anatel, the agency that regulates telecoms in Brazil, found the system unavailable. Federal courts in the country cut outside access to their own systems that morning. In the Netherlands, the service citizens use to identify themselves on government websites went offline, and so did the website of the country's own cybersecurity centre. In France, the Interior Ministry pulled local administration websites, including the one run by the Paris police prefecture.

In these cases the organisations described the measure as preventive, and there is no public confirmation that the systems were broken into. They were switched off on purpose, while technical teams waited for or installed a fix for two security flaws in PHP.

PHP is the program that works behind the scenes on a large share of websites. When someone opens a page, it is PHP that assembles the content on the server and sends the finished page to the browser. A flaw in it works like an unlocked door that opens on millions of sites at once, with nothing for the ordinary visitor to install or update on their own computer. The two flaws became public this week ahead of the schedule agreed between the researchers who found them and the people who maintain the language, and with attempted attacks already recorded.

What PHP is, and why one flaw reaches so many sites at once

PHP is free, open source and maintained by volunteers. Website owners rarely deal with it directly, which is part of the problem: many do not know who updates it on the computer that hosts their pages.

According to a service that tracks web technologies, almost 70% of websites whose programming language can be identified use PHP. It is the engine under WordPress, the publishing system behind roughly 40% of all websites, and also under Drupal, Joomla and Magento, used by news portals, online shops and government services.

The flaws are in the core of the language, not in a plugin or a particular site. According to the researchers and to security agencies, they could allow someone to run commands on a vulnerable server over the internet without a password or an account, which could lead to data theft, defaced pages or full compromise of the system, as the hosting provider GoDaddy put it. Each flaw was rated 9.2 on a 10-point severity scale used across the industry. That score measures how serious the flaw is, not the chance that any given website was broken into.

From the leak to the fix, a race against the clock

The flaws were reported privately in August and kept secret while a correction was prepared. On Monday the 20th, the maintainers gave advance notice that patches were coming, and reserved the right to release them earlier if details became public or if evidence of attacks appeared.

That is what happened. According to the PHP Foundation, the nonprofit that funds work on the language, details started circulating on forums and social media on Tuesday, so the disclosure was brought forward. The fix came out on Wednesday.

Before it did, the chief technology officer of Cloudflare, an internet infrastructure and security company, wrote on X: "We are seeing early attacks emerging and are updating mitigations as new vectors show up. This is a stopgap only. Patch as soon as PHP releases the update."

Amazon went further. In a post published on Wednesday evening, its security chief, CJ Moses, said the company had found an attempt to exploit the flaws on 17 October, four days before the public disclosure, against a server it keeps on purpose to attract attackers. The attempt came from an address linked to a service that hides where a connection originates. Amazon says this suggests a deliberate attacker, but does not identify who, and says it remains unclear how the attacker learned about the flaws while they were still secret. That episode concerns Amazon's decoy server, not the government systems that went offline.

The executive director of the PHP Foundation, Elizabeth Barron, told the US technology magazine WIRED that, to the organisation's knowledge, there had been no successful attempt to run code remotely.

Artificial intelligence helped reveal flaws that sat there for twenty years

The problems are not new. According to the security firm owned by Google that studied them, the flaws had been in PHP for roughly twenty years, and demonstrating that they could actually be exploited required "an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve".

Artificial intelligence changed that. A security company working with OpenAI reported the first flaw on 11 August, after identifying it with one of the company's models. The Google-owned firm reported a second flaw on 24 August, also using such models. The foundation says an attack along these lines had already been theorised in 2024, but no concrete route was found at the time.

The same capability works in the other direction. In its research post, the Google-owned firm wrote that these models can help adapt an attack to different versions, configurations and setups of PHP, which used to be the main obstacle. That describes what the technology can do, not what happened in each specific attack. Moses, of Amazon, wrote that the time between a fix being published and a working attack existing "is shrinking for structural reasons", and that in his assessment more actors can now act within hours or even minutes of technical details becoming public.

Who went offline, from Europe to Brazil

Digital security agencies in Europe, Asia and Oceania issued warnings through the week, and organisations in at least seven countries suspended services as a precaution. In the Netherlands the shutdown reached government portals, hospital websites and the Port of Rotterdam. In Finland, the state IT provider took public network services offline. Germany and Belgium pulled pages of federal bodies and of the foreign ministry. In Denmark, a public technology company suspended services used by municipalities, including a national school communication platform. The Wikimedia Foundation said it had taken down some systems until they could be safely updated.

In Brazil, Anatel confirmed to the technology site Canaltech that it had temporarily removed its electronic document system. "This is not a flaw or vulnerability inherent to the system," the agency said. "The temporary unavailability is related to a recent vulnerability identified in PHP itself." Federal courts followed. The First Region court suspended external access to the same document system, the federal courts serving Rio Grande do Sul, Santa Catarina and Paraná cut outside access to their systems from 11am, and in Minas Gerais the federal courts suspended business and procedural deadlines, according to the news site O Fator.

The federal government's cyber incident response centre, linked to the Presidency's Institutional Security Office, published an alert asking institutions to identify systems using PHP and install the corrected versions immediately, and to consider temporarily suspending external access where that was not possible.

Who looks after the program the web runs on

PHP is maintained by volunteers and by developers funded by the foundation, which runs on donations. According to the British newspaper the Guardian, it keeps the language going with 13 full-time and part-time engineers.

In a statement, the foundation said that "tools now find bugs faster than ever, for defenders and attackers alike, and the number of reports will keep growing", and called on technology companies to organise a coordinated response to avoid major disruption to online services.

Alan Woodward, a cybersecurity professor at the University of Surrey, told the Guardian that the troubling part is the long tail of sites that are not well maintained. In his assessment, those will remain vulnerable, and attacks may continue for weeks and months.

What to do with this information

If you only browse the web, there is nothing to install or update on your computer or phone. The flaw is on the side of the websites, and fixing it is the job of whoever runs the server. A site being available does not prove it is vulnerable, and a site being offline does not prove it was attacked.

If you run a website, even a simple blog, the correction has to be applied to PHP on the server. Updating WordPress, its themes or its add-ons does not solve the problem, and WordPress itself has said there is no update of its own that fixes this. If your site sits with a hosting company, the practical step is to contact it, confirm whether the correction has been applied and check with the company who is responsible for that update, since it is not always the provider. Security authorities recommended that organisations unable to install the fix in time consider taking the affected systems offline until they can. That is guidance for that specific situation, not a rule that every site should be shut down.

Publishing the fix is not the same as installing it, and the risk lasts as long as someone has not. That is why cybersecurity agencies in Europe, the United Kingdom and Brazil are expected to keep issuing alerts in the coming weeks about sites that have not been updated. Do you know who is responsible for updating the software behind the websites and digital services you depend on?