Why a PHP bug is a business risk, not just an IT problem: 'Next step could be the mass compromise of...'

A decade-old PHP vulnerability affecting software behind about 75% of identifiable websites has triggered emergency fixes and service shutdowns across Europe.

A critical vulnerability in PHP, a programming language that powers a large share of the internet, has forced government agencies and organisations across Europe to take websites and online services offline, pointing to the business risks posed by security flaws in widely used software.

The vulnerabilities, which remained hidden in PHP's code for more than a decade, were discovered with the help of artificial intelligence (AI). Developers released emergency fixes on Wednesday, urging users to update immediately as cybersecurity firms warned that hackers were already attempting to exploit the flaws.

PHP underpins about 75% of websites whose programming language can be identified, according to web technology tracker W3Techs. It is also embedded in widely used content management systems, including WordPress, Drupal, Joomla and Magento, exposing a vast number of websites to potential disruption.

Why is a PHP bug a business risk too?

The scale of the threat makes the vulnerability more than an IT problem. Organisations that depend on PHP-powered websites to provide public services and communicate with customers face the risk of losing access to essential online systems while they patch their software.

"All servers using any version of PHP released in the last 20 years will be vulnerable," Tiffany Farriss, interim chief executive of the Drupal Association, told Reuters. "This issue impacts the majority of the internet."

According to internet intelligence firm Censys, about 1.5 million of 2.6 million hosts report running a PHP version for which no fix is available.

AI accelerates the risk

The vulnerabilities were discovered independently by cybersecurity companies Calif and Wiz using AI tools. Wiz said the flaws would have been extraordinarily complicated for a human hacker to exploit, but AI has changed the equation.

"Pre-AI, this manual work would be difficult to implement and even harder to scale," Wiz said in a blog post. "With AI, this is no longer a barrier."

Costin Raiu, co-founder of cybersecurity research and incident response firm TLP, described the situation as a "race to exploit" powered by AI. He warned that the next step could be the "mass compromise of every vulnerable web server on the internet."

Amazon's security chief CJ Moses said the company's security team detected an attempted exploit against a decoy system on October 17, four days before public disclosure. More attempts followed on Wednesday, with Amazon saying the vulnerabilities were "now being broadly exploited in the wild."

Website shutdowns expose the business impact

The immediate response has involved taking systems offline to prevent potential attacks. In the Netherlands, affected organisations included the Port of Rotterdam, government portal Overheid.nl, hospital websites and the websites of the country's five largest political parties.

In Denmark, IT company Kombit shut down several services, including the national school communication platform. Finland's state IT services provider Valtori took government public network services offline, while France's Interior Ministry placed all its websites under preventive maintenance.

Cybersecurity experts warned that smaller websites could face greater risks because their operators may have limited technical resources and rely on shared hosting services.

Lukasz Olejnik, a visiting senior research fellow at King's College London, said AI-assisted hacking campaigns could cause widespread damage to unpatched servers.

"The scale is huge, and with AI, exploitation may happen instantly," Olejnik said.