What is PHP? The cybersecurity issue which saw multiple government websites taken offline

Want to bookmark your favourite articles and stories to read or reference later? Start your Independent Membership today.

Already a member? Log in

The government websites of multiple European nations were taken offline on Wednesday as administrators scrambled to address two critical security flaws in PHP – one of the internet’s most prevalent programming languages.

After PHP’s developers announced patches for the vulnerabilities on Wednesday , EU cybersecurity officials advised organisations to take affected sites offline if the fixes could not be applied immediately.

Behind the scenes, PHP powers websites by assembling page content on the server and sending the finished page to a browser.

It is free, open source and maintained by volunteers, with site owners rarely interacting with it directly.

According to web technology tracker W3Techs, PHP runs nearly 70 per cent of websites whose programming language can be identified.

It is the engine behind WordPress, the software that powers 40 per cent of all websites such as blogs, small business pages, government portals, online shops and news sites.

What are the risks of the flaws?

The two vulnerabilities are rated 9.2 out of 10 on the CVSS v4.0 severity scale, a standard industry scoring system.

CERT-EU, the European Union 's cybersecurity response team, said that rating signals unauthenticated remote code execution, meaning an attacker can run commands on a vulnerable server over the internet with no password or account.

A single flaw in PHP opens the same door on millions of servers at once. Whoever exploits the flaw controls the website.

GoDaddy , a web hosting provider, said that could mean stolen data, defaced pages or full-system compromise. Cloudflare 's chief technology officer said early attacks were emerging.

Most small websites are typically run by owners with no security staff, often on shared hosting where they do not manage the server and may not know who updates PHP.

Wordfence, a security plugin for WordPress sites, warned that the usual automatic updates will not apply this fix. CERT-EU's guidance is to take affected sites offline rather than leave them exposed.

How were the flaws found?

Researchers at security firm Calif, working with OpenAI , reported the first flaw to PHP on August 11 after finding it with OpenAI's GPT-5.6 Sol model, the company said.

Wiz, a security firm owned by Alphabet's Google, found the flaws independently and reported a second one on August 24, also using AI models.

Wiz said the findings "rank among the most severe vulnerabilities discovered in PHP, and arguably in software history."

The underlying flaws had been present for decades, the firm said, but proving they were exploitable required a chain of steps "at the edge of what human researchers could practically achieve."

US President Donald Trump 's administration said it was "tracking and coordinating with federal agencies and leading SI labs to expedite the release of the fix," referring to Trump's preferred name for artificial intelligence.

It framed the discovery as evidence that American "Super Intelligence" strengthens national security.

Join our commenting forum

Join thought-provoking conversations, follow other Independent readers and see their replies