PHP security flaws put 70% of the internet at risk, says Wiz

SENSEX 73,569.83

 -139.86

NIFTY 22,749.90

 -61.45

CRUDEOIL 9,430.00

+ 222.00

GOLD 144,227.00

 -1,852.00

SILVER 203,162.00

 -6,006.00

SENSEX 73,569.83

 -139.86

NIFTY 22,749.90

 -61.45

NIFTY 22,749.90

 -61.45

CRUDEOIL 9,430.00

+ 222.00

CRUDEOIL 9,430.00

+ 222.00

GOLD 144,227.00

 -1,852.00

'; } document.getElementById("lgdv").innerHTML = htmlElements; } function numberformat(i) { return Number(parseFloat(i).toFixed(2)).toLocaleString('en', { minimumFractionDigits: 2 }) } async function gatherResponse(response) { const { headers } = response; const contentType = headers.get('content-type') || ''; if (contentType.includes('application/json')) { return await response.json() } return response.text(); } function getWidth() { if (Math.max(document.body.scrollWidth,document.documentElement.scrollWidth,document.body.offsetWidth,document.documentElement.offsetWidth,document.documentElement.clientWidth) > 991) { document.getElementById("mob").style.display = "none"; document.getElementById("lgdv").style.display = "block"; } else { document.getElementById("mob").style.display = "block"; document.getElementById("lgdv").style.display = "none"; } } getWidth(); THIS AD SUPPORTS OUR JOURNALISM. SUBSCRIBE FOR MINIMAL ADS.THIS AD SUPPORTS OUR JOURNALISM. SUBSCRIBE FOR MINIMAL ADS.

Cybersecurity experts are urging organisations to identify vulnerable systems, apply software updates and assess potential attacks involving the widely used programming language

By Bloomberg

Updated - October 22, 2026 at 11:53 AM.

FILE PHOTO: Cybersecurity experts have warned of two PHP vulnerabilities that could expose websites and software platforms to cyberattacks. | Photo Credit: TOBY MELVILLE

The US government is working to address and stop any potential cybersecurity issues stemming from flaws in PHP, a widely used open-source software, that may impact federal agencies and American critical infrastructure, according to a White House official.

The programming language, called PHP, contains two vulnerabilities which could potentially expose organizations using it in websites and software platforms to cyberattacks. The developers responsible for maintaining PHP said Wednesday they released software updates to patch the vulnerabilities, urging users to adopt those changes immediately. The US government is coordinating with technology companies to adopt the security fix, according to a White House official.

• Read also: Europe takes government websites offline over critical PHP security vulnerabilities

PHP is one of the web’s most widely deployed technologies, underpinning millions of websites. Any vulnerability could therefore cascade through the internet’s software supply chain, potentially exposing online services to data theft, malware and breaches. Taking sites offline means attackers can’t reach and exploit the flaw while it’s being fixed.

AI tools helped identify vulnerabilities that existed for years

Alphabet Inc.-owned cybersecurity company Wiz said in a report published Wednesday that it had discovered the vulnerabilities with the help of several artificial intelligence tools. It said it had collaborated with OpenAI and the cybersecurity firm Calif on the work. Wiz’s report estimated that the PHP vulnerability affected around 70% of the internet and had existed undetected for more than a decade, but AI tools helped quickly identify a fix for them.

“With frontier AI models and the right tools, a single researcher completed in a week what previously would have taken a world-class team months of work,” it said.

US agencies coordinate response as Europe takes websites offline

The US Office of the National Cyber Director was coordinating with the Federal Bureau of Investigation, the Cybersecurity and Infrastructure Security Agency, the National Security Agency and others to remediate the issue.

Governments in Europe were taking websites offline Wednesday in response to warnings about the critical security vulnerabilities. Finland’s government said it was taking offline all public-facing internet services as a precautionary measure. Dutch national and local government websites were also taken down.

The UK’s National Cyber Security Centre said in an alert Wednesday that organizations should work to identify any systems running PHP, check them for malicious activity, and consider taking them offline until the vulnerabilities can be mitigated.

Dutch authorities and European universities affected

The websites for the Dutch House of Representatives and the National Cyber Security Centre couldn’t be reached as of 5:40 p.m. local time. Dutch news agency ANP reported more than 100 municipalities, provinces and water boards were affected as they use a service provided by software firm Notubiz. Notubiz counts 254 Dutch local authorities as customers, according to its website. Notubiz did not immediately respond to a request for comment.

Some universities in Germany and Austria have also pulled their sites, including the University of Vienna and the University of Freiburg.

PHP’s widespread use makes identifying vulnerable systems difficult

PHP is “everywhere” and quietly powers websites that run using WordPress, Drupal, Joomla and Magento, according to the cybersecurity firm Huntress. PHP is also present “under the hood” of software, even though the software may not advertise that it is using it, Huntress said.

When there is a critical vulnerability in PHP, Huntress advised in a report on Wednesday, “the number of places you have to go looking to identify vulnerable PHP versions gets very big, very fast.”

Cloudflare reports early attempts to exploit flaws

Dane Knecht, chief technology officer at cybersecurity firm Cloudflare Inc., said in a post on X that his company had observed some “early attacks” attempting to exploit the vulnerabilities. In response, he said, Cloudflare had introduced protections for customers whose sites were shielded using its technology.

More stories like this are available on bloomberg.com

Published on October 22, 2026

THIS AD SUPPORTS OUR JOURNALISM. SUBSCRIBE FOR MINIMAL ADS. THIS AD SUPPORTS OUR JOURNALISM. SUBSCRIBE FOR MINIMAL ADS. THIS AD SUPPORTS OUR JOURNALISM. SUBSCRIBE FOR MINIMAL ADS. THIS AD SUPPORTS OUR JOURNALISM. SUBSCRIBE FOR MINIMAL ADS.Sign into Unlock benefits!

• Access 10 free stories per month
• Get notified by email for early preview to new features, discounts & offers