PHP Flaws Prompt Website Shutdowns Amid Attack Surge

Two critical vulnerabilities in PHP, which underpins roughly 70% of websites, could allow unauthenticated attackers to run code remotely, access sensitive data and take control of affected servers; researchers found the flaws with help from AI tools, and PHP released security updates. Governments and businesses in Canada, Europe, Japan and elsewhere temporarily shut down or limited online services while addressing the flaws, and reports of attempted exploitation surged into the millions, though widespread successful exploitation has not been confirmed. Security agencies urged organisations to patch promptly or take exposed systems offline, while Cloudflare added temporary firewall protections and Wordfence warned that automatic updates would not install the PHP fix. The incidents highlighted the risks to organisations with ageing or poorly maintained systems and the growing role of AI in uncovering difficult-to-find vulnerabilities.