Two critical security flaws in the PHP programming language have prompted governments and major organisations to take public websites offline while a patch is applied, officials and cyber‑security firms said.
Immediate action to avoid server compromise
Security agencies around the world issued urgent advice after developers released a fix on Wednesday afternoon. Organisations unable to update immediately were advised to consider taking services offline to prevent potential exploitation.
The scale of the response has been significant: national and municipal websites, public services and large platforms temporarily ceased public access while teams worked to apply the update.
- Finnish government — temporarily shut down public web services.
- Netherlands' cyber‑security agency — took its website offline.
- Edinburgh council — website inaccessible.
- BBC — several programme pages taken down (including Doctor Who and The Traitors listings).
- Wikimedia Foundation — removed a number of systems as a precaution, affecting parts of Wikipedia.
- DeviantArt — reported the site was temporarily down for maintenance.
Risk described as direct path to sensitive data
The United States' National Security Agency posted guidance on X, urging organisations to take systems offline if they could not apply the patch quickly. The agency warned of the potential impact on server integrity.
"These vulnerabilities often provide a direct path to the server's file system or database," the agency wrote.
Cyber‑security firms Wiz and Calif discovered the flaws. Wiz described the findings as among the most serious produced by the AI tools used to uncover them, saying they were the "most severe vulnerabilities ever discovered" by that technology.
The White House said federal departments were collaborating with leading AI laboratories to accelerate remediation work. Japan's prime minister, Sanae Takaichi, used social media to urge operators of publicly accessible websites to verify whether they relied on PHP.
How organisations are responding
Responses have varied from immediate patching to temporarily taking services offline until a safe update could be applied. The Wikimedia Foundation confirmed it had taken multiple systems down as a protective measure, noting that some users would be unable to access parts of Wikipedia while the work continued. The BBC and Edinburgh council were reported to have pages inaccessible; the BBC has been approached for confirmation of a link to PHP.
| Organisation | Reported action |
|---|---|
| Finnish government | Public web services shut down |
| Netherlands cyber‑security agency | Website taken offline |
| Wikimedia Foundation | Several systems taken down while patched |
| Edinburgh council / BBC / DeviantArt | Pages/services temporarily inaccessible or down for maintenance |
Cyber‑security teams said the vulnerabilities could allow attackers to reach a server's underlying file system or databases, raising the risk of data loss or full system takeover if exploited. That risk prompted swift, precautionary shutdowns of services where administrators could not immediately apply the patch.
Software written in PHP powers a large portion of the internet, which magnified the potential impact and explains the scale of the global response. The use of AI in the discovery was highlighted by the firms that found the flaws, underlining both the accelerating role of automated tools in cyber‑security and the new kinds of risks they can reveal.
Organisations and administrators are expected to treat the patch as a priority. For the public, temporary outages on affected sites are likely to continue while teams verify systems are secure and updates are deployed.
Authorities and cyber‑security specialists have reiterated the standard advice: apply the vendor fix as soon as possible, monitor systems for unusual activity and, where immediate patching is not feasible, take public‑facing services offline until they can be secured.
