The flaws could allegedly allow cybercriminals to gain complete control of vulnerable servers without requiring passwords or other authentication credentials. The reported threat has prompted urgent calls for software updates, with organisations responsible for sensitive digital infrastructure taking precautionary measures to reduce their exposure to possible attacks.
PHP developers have reportedly released emergency security patches and urged website administrators to install the updates immediately. The language supports a substantial proportion of the modern internet, including government portals, online marketplaces, news organisations and content management systems.
According to figures attributed to cloud security company Wiz, approximately 70 per cent of websites worldwide use PHP. The company has reportedly described the newly identified vulnerabilities as among the most serious security weaknesses discovered in the programming language’s history.
The widespread adoption of PHP means that a significant vulnerability could have consequences extending far beyond individual websites. Depending on the affected configurations, attackers exploiting such weaknesses could potentially access confidential databases, alter website content, disrupt essential services or compromise sensitive information.
Security Experts Draw Comparisons With Heartbleed
Volker Dusch, identified in the original report as a security engineer associated with the PHP Foundation, reportedly told The Wall Street Journal that the vulnerabilities represented the most serious PHP security crisis in more than a decade.
He drew comparisons with Heartbleed, the major security vulnerability disclosed in 2014 that affected the OpenSSL cryptographic software library.
Heartbleed exposed weaknesses in systems responsible for protecting communications across the internet, forcing organisations worldwide to update affected software and review their security arrangements.
The comparison reflects concerns about the potential scale of the reported PHP vulnerabilities, particularly given the programming language’s extensive use across public and private digital services.
The United States National Security Agency (NSA) has also reportedly issued an urgent warning through social media platform X, advising organisations to update vulnerable systems without delay.
According to the report, the agency recommended disconnecting affected servers from the internet if immediate installation of security patches was not possible.
Such precautions are intended to prevent unauthorised access while technical teams assess vulnerabilities and implement appropriate safeguards.
If attackers successfully exploit a server-level weakness, the consequences could include unauthorised access to databases, application files and other resources, depending on the permissions available to the compromised process.
Artificial Intelligence Reportedly Helped Identify Vulnerabilities
The original report claims that the vulnerabilities were first identified in August during an artificial intelligence-assisted examination of PHP’s source code.
A cybersecurity organisation identified as Calif reportedly discovered the weaknesses while conducting research funded by OpenAI. The investigation allegedly involved an AI model referred to as GPT-5.6 Sol.
The report also claims that Google-owned cybersecurity company Wiz independently identified the same vulnerabilities through research involving AI systems described as Gemini 4 Argon and GPT-5.6 Sol.
OpenAI was subsequently reported to have highlighted the findings in a post on X, presenting the discovery as evidence that advanced artificial intelligence systems could identify significant structural weaknesses in widely deployed software.
However, the specific claims concerning the researchers, AI model names and circumstances of the discovery have not been independently verified.
Artificial intelligence is increasingly being explored as a tool for examining software code, identifying potential vulnerabilities and assisting security researchers with complex technical investigations.
Such systems can help analyse large codebases and identify patterns that might otherwise require extensive manual examination. Their findings, however, still require technical validation to establish whether a suspected weakness is genuine and exploitable.
European Governments Reportedly Suspend Online Services
The reported security concerns have prompted precautionary measures in several European countries.
France’s Interior Ministry has reportedly suspended access to several government websites following advice from the country’s national cybersecurity authorities.
The affected services are said to include websites operated by the Paris police and various local administrative bodies.
The measures were reportedly introduced to minimise potential exposure while security teams assessed the risks associated with the vulnerabilities.
In the Netherlands, national broadcaster NOS reportedly stated that several important government platforms had been taken offline as a precaution.
These allegedly included DigiD, the country’s digital identity verification service, alongside websites associated with the Dutch parliament and the National Cyber Security Centre.
DigiD plays an important role in enabling residents to access government services and other participating organisations securely. Any interruption to such a system can affect users who depend on digital identity verification for routine administrative activities.
Belgium’s Foreign Ministry has also reportedly temporarily suspended its official online portal as part of precautionary security arrangements.
The reported shutdowns illustrate the potential disruption that software vulnerabilities can cause when widely used technologies underpin essential public services.
Australian Cybersecurity Portal Among Reportedly Affected Sites
Concerns have also extended beyond Europe.
According to information attributed to the Australian Broadcasting Corporation, the official cybersecurity portal associated with the Australian Signals Directorate was among the websites potentially affected by the PHP vulnerabilities.
The Australian Signals Directorate plays a significant role in the country’s national cybersecurity framework, including providing guidance to organisations seeking to strengthen their protection against digital threats.
The reported inclusion of its cybersecurity portal has raised questions about the potential reach of the vulnerabilities.
However, a website being identified as potentially vulnerable does not necessarily mean that attackers have successfully compromised it.
Similarly, temporarily taking a website offline may be a preventive decision rather than evidence of an actual cyberattack.
Determining whether a system has been compromised requires technical investigation, including examination of server activity, access records and other relevant security evidence.
Urgent Updates Remain Central to Cyber Defence
The incident highlights the importance of maintaining updated software across digital infrastructure.
Security patches are designed to correct identified weaknesses, reducing the opportunities available to attackers seeking to exploit vulnerable systems.
For organisations operating PHP-based services, the appropriate response would depend on the precise vulnerabilities involved, the versions of PHP in use and the configuration of their servers.
Security specialists generally recommend maintaining supported software versions, restricting unnecessary access privileges, monitoring suspicious activity and keeping reliable backups of important data.
Government agencies and organisations handling financial or personal information face particularly serious consequences if their systems are compromised.
A successful intrusion could potentially expose confidential records, interrupt public services or undermine confidence in the security of digital platforms.
The reported discovery also demonstrates the growing relationship between artificial intelligence and cybersecurity research. While advanced tools may accelerate the identification of weaknesses, the effectiveness of any response ultimately depends on accurate technical assessment and timely corrective action.
Verification remains an important limitation in this case. The source report does not identify the two vulnerabilities by their Common Vulnerabilities and Exposures (CVE) numbers, specify the affected PHP versions or provide details of the alleged emergency security releases. The reported government shutdowns, official warnings and AI-assisted discoveries have also not been independently confirmed.
Until authoritative technical advisories and official statements establish those details, the full scale of the reported threat and the number of genuinely affected websites remain uncertain.
