Wiz Discovers PHP Vulnerabilities Affecting Major Portion of Internet, Prompting Global Responses

Alphabet Inc.-owned cybersecurity company Wiz reported the discovery of two vulnerabilities in PHP, a widely used open-source programming language that underpins millions of websites globally. According to Wiz, the flaws had existed undetected for more than a decade and could potentially affect around 70% of the internet.

The developers responsible for maintaining PHP released software updates to patch the vulnerabilities and urged users to apply the changes immediately. Wiz stated that it discovered the vulnerabilities with the help of artificial intelligence tools, collaborating with OpenAI and the cybersecurity firm Calif. The company noted that AI tools significantly accelerated the process of identifying a fix.

Cloudflare Inc. Chief Technology Officer Dane Knecht stated on X that the company had observed early attacks attempting to exploit the vulnerabilities and had introduced protections for its shielded customers.

Governments and organizations worldwide responded to the warnings by taking websites offline as a precautionary measure. In Europe, Finland took offline all public-facing internet services. Dutch national and local government websites were also taken down, affecting services tied to software firm Notubiz. Additionally, universities in Germany and Austria, including the University of Vienna and the University of Freiburg, pulled their sites.

The US government is working to address issues stemming from the flaws, according to a White House official. The US Office of the National Cyber Director is coordinating with the Federal Bureau of Investigation, the Cybersecurity and Infrastructure Security Agency, the National Security Agency, and other entities to remediate the issue.

The UK’s National Cyber Security Centre issued an alert advising organizations to identify systems running PHP, check for malicious activity, and consider taking systems offline until the vulnerabilities can be mitigated.

Cybersecurity firm Huntress noted that PHP is heavily embedded in software and powers websites running on WordPress, Drupal, Joomla, and Magento, making it difficult to quickly locate all vulnerable instances across the software supply chain.

"This incident highlights the critical reliance of the global digital infrastructure on open-source software like PHP. When a vulnerability impacts such a foundational technology, it poses immediate risks to the software supply chain across businesses and government agencies alike. Organizations must prioritize rapid patch management, system audits, and proactive security measures to safeguard their digital assets against emerging cyber threats." — Dr. Shishir Gupta, Founder & CEO, StartupLanes