Severe vulnerabilities in the PHP: Hypertext Preprocessor, identified with the help of AI, have prompted cybersecurity experts to warn that millions of websites could be affected, leading to urgent action by agencies and governments worldwide.
AI uncovers critical flaws in PHP
On Wednesday, AI brought to light vulnerabilities in the PHP content management system, which powers sites like Wikipedia and WordPress. Security researchers, using OpenAI technology, uncovered a flaw that could allow attackers to take control of affected web servers.
Experts have described the situation as serious, noting that the vulnerability could give bad actors access to data and critical networks of government and business pages. The scale and nature of the issue have heightened concerns.
Remote code execution risk
Alan Woodward, a visiting computer science professor at the Surrey Centre for Cyber Security, told BBC Radio 4's Today programme: "We're talking something like 30 million websites out there – we're certainly getting off of that number – but also the nature of it."
He added: "It's not just the vast volume of websites that use it, but this is called a remote code execution vulnerability, and what that means is an attacker can get their own code onto the web server and run it, and basically do whatever they like. They can steal data, they can go to other parts of your network, all sorts of things like that. Even plant the backdoor to get in later on, so you can see, pretty serious."
Patches and exploitation attempts
The PHP Foundation identified two Common Vulnerabilities and Exposures (CVEs), CVE-2026-109618 and CVE-2026-109619. The vulnerabilities exist in "all PHP installations serving web requests" and go back to PHP version 5, released in 2004. PHP 8.2 and newer services will receive patches, with an alert warning: "There are no complete mitigations, updating is the only safe choice."
Since the flaws were identified, there have been "millions" of exploitation attempts launched at PHP-based sites. In the UK, the official sites of the Office for Government Responsibility (OBR), Oxfordshire County Council and Hillingdon Council were among those forced to switch off and update their systems.
Global impact and government response
Matthew Prince, CEO of internet services firm Cloudflare, wrote on X: "In the 10 hours before it was publicly announced, across the network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within two hours, and millions now."
Lukasz Olejnik, a visiting senior research fellow at King's College London, told Wired magazine: "This is not a drill." He added: "The impact is enormous. Especially if attackers would turn to exploiting these vulnerabilities fast. Worst case is wormable malware affecting big chunks of the internet."
Chris Dimitriadis, Chief Global Strategy Officer at ISACA, said: "A single vulnerability can trigger a global domino effect across borders and industries within hours. What we're seeing with PHP is a stark reminder that the global economy runs on complex, interconnected digital systems, and that hidden security weaknesses in them are now being found at unprecedented speed with the help of AI."
A spokesperson for the Government said work was underway to "identify and patch any potential exposure", adding: "We encourage all organisations - private and public, large and small - to follow guidance issued by the NCSC to understand their exposure and take the necessary actions to safeguard their systems."
The Government has confirmed that the security of next week's Budget has not been compromised by the flaw. Scotland Secretary Douglas Alexander told Times Radio: "No, I've had no indication whatsoever that there's any problem in terms of a breach of Budget security." He noted that John Healey initiated new security protocols reflecting his experience in the Ministry of Defence when he came to the Treasury as Chancellor in the summer.
