Half the PHP Web Has No Fix. Hackers Know It.
AT A GLANCE
- Dutch, French, Danish and Finnish government sites went offline on Wednesday
- AI tools found flaws that sat in PHP code for over a decade
- About 1.5 million of 2.6 million hosts run a PHP version with no fix, says Censys
- Amazon spotted an exploit attempt on October 17, four days before disclosure
A bug in the language behind roughly 75% of identifiable websites has operators everywhere racing to patch or shut down.
Government websites across Europe went dark on Wednesday after PHP developers disclosed critical flaws. They released urgent fixes and told all users to update immediately. Some hackers were already exploiting the holes.
KEY DETAILS
Security firms Calif and Wiz both found the flaws with AI. Wiz used its Atlas tool along with Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol.
Amazon security chief CJ Moses said a decoy system was hit on October 17. More attempts by several actors followed on Wednesday. Amazon says the flaws are now being broadly exploited in the wild.
The Dutch cybersecurity agency, Port of Rotterdam, Overheid.nl, the KNVB and several hospitals went offline. Finland’s Valtori shut down public network services as a precaution. France’s Interior Ministry put all its sites into preventive maintenance. Denmark’s Kombit paused several services, including the national school platform. Wikipedia’s operator took some systems down, and the Internet Archive briefly went offline.
WHY IT MATTERS
PHP runs WordPress, Drupal, Joomla and Magento. Drupal Association interim chief Tiffany Farriss said any PHP version from the last 20 years is vulnerable. Small sites on shared hosting face the biggest risk. Costin Raiu of TLP: Black expects a race to exploit, ending in mass compromise of vulnerable servers.
Keep an eye on how fast patches roll out, how many sites come back online, and whether attacks spread.
Stay ahead of every market-moving headline with QuoMarkets.
Source: Reuters
