Two security holes in PHP - the open source language behind millions of websites and software platforms - could expose organizations to cyberattacks. The PHP team pushed fixes on Wednesday and called for rapid adoption. Pulling sites offline during patching prevents attackers from reaching the vulnerable code while teams work.
Because PHP underpins a huge slice of the web's software supply chain, weaknesses can spill into data theft, malware, and service breaches. In plain English: one weak link here can tug on a lot of your portfolio's web-facing names at once.
Wiz said it identified the flaws using several AI tools, working with OpenAI and the security company Calif in the process. The company estimated the PHP exposure reaches around 70% of the internet and that the issues had persisted undetected for over ten years, but AI helped quickly zero in on a fix.
"With frontier AI models and the right tools, a single researcher completed in a week what previously would have taken a world-class team months of work," the report said.
European governments moved quickly Wednesday. Finland said it was taking all public-facing internet services offline as a precaution. Authorities in the Netherlands also took down national and municipal government sites; by 5:40 p.m. local time, the Dutch House of Representatives and the National Cyber Security Centre were unreachable.
According to Dutch news agency ANP, more than 100 local bodies - municipalities, provinces and water boards - felt the effects because they depend on a service provided by the software firm Notubiz. According to its website, Notubiz serves 254 Dutch local authorities as clients, and the company did not promptly answer a request for comment.
When technology and markets intersect, staying informed helps you act wisely, so sign up for our free Market Briefs
Universities in Germany and Austria likewise removed websites, among them the University of Vienna and the University of Freiburg. The UK's National Cyber Security Centre urged organizations to locate any PHP systems, look for signs of malicious activity, and, if needed, temporarily take them offline until mitigations are applied.
Huntress called PHP "everywhere," noting it quietly powers WordPress, Drupal, Joomla and Magento, and often sits under the hood of other software. When a critical PHP flaw surfaces, the firm said, the places you need to check for vulnerable versions grows very large, very fast.
Dane Knecht, Cloudflare's chief technology officer, wrote on X that the firm had observed "early attacks" trying to take advantage of the vulnerabilities. He added that Cloudflare, in turn, rolled out protections for customers whose sites rely on its shielding technology.
A White House official said the U.S. government is working alongside technology companies to implement the security fix, while also moving to prevent and repair potential cybersecurity problems that could affect federal agencies and critical infrastructure. The Office of the National Cyber Director is coordinating with the Federal Bureau of Investigation, the Cybersecurity and Infrastructure Security Agency, the National Security Agency and others.
The bottom line: emergency fixes to a core web technology can mean downtime, higher monitoring costs, and risk repricing across software, hosting, and security names. It also spotlights how AI is compressing timelines from discovery to remediation, reshaping both cyber risk and response costs across your portfolio.
Because small vulnerabilities can have broad effects, keep a clear view of the landscape by joining our free Market Briefs newsletter
