Critical PHP Flaws: Websites Go Offline as Hacking Attempts Hit Millions

Governments and companies took websites offline and rushed to apply a PHP patch on Thursday, October 22, after hacking attempts reached the millions against critical PHP flaws in one of the most widely used programming languages on the internet.

The PHP security team issued a warning on Tuesday about two critical vulnerabilities, each scoring 9.2 out of 10 on the Common Vulnerability Scoring System. Fixes were released on Wednesday, October 21, in PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Wiz Research, one of the firms that reported the bugs, said every version back to 5.4 is affected by at least one of them. The flaws had sat in the code for more than a decade.

Two security firms, Wiz and Calif, found the PHP flaws with artificial intelligence. They used OpenAI’s GPT-5.6 Sol and Google’s Gemini 4 Argon, and Wiz also used its own research tool, Wiz Atlas. Calif said it reported its bug to the PHP team on August 11. Wiz, which Alphabet owns, followed on August 24 with a second one. Wiz said the weaknesses had existed for decades, but that chaining them into a working attack was so complicated that human researchers would have found it very hard to do by hand. “With AI, this is no longer a barrier,” the company said.

The European Union’s cybersecurity response team said the rating points to unauthenticated remote code execution. A hacker could remotely take control of an affected server through the internet without any login credentials. GoDaddy warned that this could mean stolen data, defaced pages, or full control of a system.

Attackers moved before the public did. Cloudflare CEO Matthew Prince said the company recorded thousands of attempts to exploit the flaw in the 10 hours before it was publicly disclosed. The number climbed to tens of thousands within 45 minutes of the announcement, then to hundreds of thousands in two hours, and into the millions by Thursday. Amazon’s security chief, CJ Moses, said a decoy system the company runs to attract hackers recorded an attempt on October 17, four days before disclosure. More attempts from several actors followed before the embargo ended, he said, and the flaws are now being broadly exploited.

Cloudflare CTO Dane Knecht said the first attacks were already being detected, prompting the company to add firewall rules targeting known exploitation techniques. Those defenses, however, apply only to servers whose traffic passes entirely through Cloudflare.

The home page of the National Cyber Security Centre website, the UK technical authority for cyber threats and incident management, is displayed on a smart phone in London, Britain, October 22, 2026. Government websites across Europe went dark on Wednesday as operators raced to patch two critical vulnerabilities in PHP, one of the most widely used programming languages on the web. REUTERS.

Governments and companies responded by pulling services until their servers were safe. Finland’s state information technology provider, Valtori, took public government web services offline. It worked overnight on the fixes and is restoring access gradually, but warned that full recovery could take days or even weeks, because every system needs testing after an update. Valtori said the outages were a precaution, with no cyberattack and no confirmed exploitation behind them.

In the Netherlands, the National Cyber Security Center took its own site down first. Others followed: the Port of Rotterdam, the government portal Overheid.nl, the national soccer association KNVB, the websites of the five largest political parties and several hospitals. The digital identity platform DigiD also went offline. France’s Interior Ministry put all of its websites into preventive maintenance, and Denmark’s municipal technology company Kombit shut several services, including the national school communication platform. Dutch Prime Minister Dick Schoof said he was monitoring the situation.

Japan took some of the heaviest disruption. Nomura, Mitsubishi UFJ Financial Group, ANA and East Japan Railway suspended some internet services. The Finance Ministry, the Meteorological Agency and the National Tax Agency suspended online services while they checked their systems. Prime Minister Sanae Takaichi urged website owners to find out whether their sites use PHP. The hosting provider Sakura Internet suspended a database appliance function.

Elsewhere, the French telecommunications group Orange suspended access to some PHP-based sites and apps at several subsidiaries. China’s industry ministry told organizations to inspect their systems and upgrade, and Tencent Cloud urged customers to install the new version. South Korea raised its private-sector cybersecurity alert level.

Cybersecurity agencies in Europe, Australia, Japan and Britain told PHP users to update right away or take websites offline until they could be patched. One report said the American National Security Agency recommended that organizations using PHP shut down their sites. CERT-EU gave the same advice to anyone who could not patch quickly. Wordfence, a security plugin for WordPress, said the usual automatic update would not cover this fix.

PHP is free, open-source software, kept going largely by volunteers. It builds a web page on the server before it reaches your browser. It runs nearly 70 percent of the websites whose programming language can be identified, according to the web technology tracker W3Techs, and it powers WordPress, which runs roughly 40 percent of all sites. Most owners never deal with it directly. That makes patching hard for small organizations, especially on shared hosting, where customers often do not know who updates the server.

The internet intelligence firm Censys counted about 2.6 million hosts running PHP, and around 1.5 million of them were on versions with no fix. Automattic, which runs WordPress.com, said its hosted services and Tumblr are safe. Wikipedia’s operator said it took some systems down until they could be patched, and the Internet Archive said it went offline briefly.

Costin Raiu, co-founder of the research firm TLP: Black, said artificial intelligence is driving a “race to exploit” and that the next stage could be mass compromise of vulnerable servers. Lukasz Olejnik, a visiting senior research fellow at King’s College London, said attacks on unpatched servers can now happen almost instantly. Microsoft Chief Executive Satya Nadella said the episode was one of the most intense security responses he had seen in a long time. The White House said it was working with federal agencies and security laboratories to speed up fixes