Key facts
- A critical flaw in PHP, used by over 70% of websites, could allow hackers to compromise millions of sites.
- Emergency patches were released on October 21 after news of the flaw leaked.
- AI tools are accelerating the exploitation of the vulnerability, creating a 'race to exploit'.
- Websites globally, including in Belgium, the Netherlands, Finland, France, and Germany, were temporarily taken offline.
- The flaw could provide a direct path to a server's file system or database.
A critical flaw in the PHP programming language, which underpins over 70% of global websites, has prompted widespread concern and website shutdowns. Cybersecurity agencies worldwide have issued urgent warnings to web developers to apply patches, as the vulnerability could allow hackers to easily compromise millions of websites and their data. The organization behind PHP released emergency patches on October 21 after news of the flaw, discovered by researchers using AI tools in August, leaked before a fix was ready. This has created a 'race to exploit' as hackers attempt to leverage the vulnerability before all systems can be updated. Several European governments and operators, including the Port of Rotterdam, have temporarily taken websites offline as a precautionary measure.