PHP Vulnerability Affects Majority of Websites, Prompting Security Warnings and Industry Response

A hackable vulnerability discovered in the PHP coding language, which underlies approximately 70 percent of all websites, has forced businesses and governments worldwide to scramble for fixes. The National Security Agency (NSA) warned that attackers could exploit these underlying code glitches to take control of web servers, steal data, disrupt services, or navigate through networks.

Security experts note that while responsibility primarily falls on software providers and organizations serving customers, the situation has been exacerbated by increasingly capable and accessible large language models. Long-hidden software flaws that were once too obscure or complex for humans to exploit are now significantly easier to surface and weaponize.

Emily Austin, principal security researcher at cybersecurity firm Censys, recommended that individuals use unique passwords for individual websites, monitor transactions, and enable multi-factor authentication (MFA). However, Austin noted that for systemic issues like PHP vulnerabilities, end users have limited direct action they can take beyond relying on services to patch the code or avoid using PHP.

Dan Guido, CEO and co-founder of Trail of Bits, advised turning on automatic updates for phones, computers, and home routers to limit the window for bad actors. Guido emphasized that consumers remain largely dependent on the services they use, pointing out that even users practicing good security habits cannot patch third-party infrastructure such as a hospital website. Guido added that companies running services must deploy fixes faster and limit the damage caused by compromised systems.

Runa Sandvik, founder of Granitt and a digital security expert, stressed the importance of updating apps and devices, including internet-connected IoT devices around the house that may not receive frequent updates from vendors.

Dr. Daniel Gardham, a lecturer at the Surrey Centre for Cyber Security at the University of Surrey, stated that organizations must maintain an accurate inventory of their software, patch promptly, and check for existing compromises. Gardham noted that while finding vulnerabilities is becoming faster and easier with AI, fixing them across reliant systems remains difficult.

Nic Adams, co-founder and CEO of 0rcus, warned that scammers frequently attempt to exploit major cybersecurity headlines. Adams advised users to be wary of unsolicited links, avoid urgent messages demanding account security, and directly check affected company apps or websites.

In the financial sector, Paul Benda, executive vice president of risk, fraud, and cybersecurity at the American Bankers Association, stated that banks have worked extensively to secure their systems against common threats. However, Benda noted that consumers must remain vigilant when interacting with random retailers or websites with lower security standards, suggesting the use of passkeys and avoiding password reuse across shopping sites.

"The recent PHP security vulnerability highlights the growing operational risks businesses face as AI tools lower the barrier for exploiting legacy software. For organizations and tech startups, infrastructure security is no longer an optional backend task; it requires rigorous asset tracking, immediate patching protocols, and proactive risk management to protect customer data and maintain operational integrity." — Dr. Shishir Gupta, Founder & CEO, StartupLanes