Organisations worldwide are racing to address critical cybersecurity vulnerabilities in the PHP programming language, with an estimated 30 million websites potentially at risk of data theft and other cyberattacks.
The vulnerabilities affect PHP, a widely used programming language that powers websites and web applications. Cybersecurity experts warn that attackers could exploit the flaws to gain access to web servers, potentially compromising sensitive information stored on affected systems.
According to the BBC, the security weaknesses were initially identified by human researchers in 2024 but were considered too complicated to exploit at the time. Advances in artificial intelligence have since helped researchers identify ways to exploit the flaws, prompting urgent calls for organisations to update vulnerable systems.
A professor at the Surrey Centre for Cyber Security, Alan Woodward warned that exploiting the vulnerabilities could allow attackers to execute their own code on a web server and potentially gain extensive control over it.
Woodward said technology companies, including Amazon and Cloudflare, had observed attempts to probe websites for the weaknesses, although it remained unclear whether the activity had resulted in confirmed attacks.
He also expressed concern that information about the vulnerabilities had emerged before the corrective update was publicly available, potentially giving attackers an opportunity to exploit vulnerable systems.
The United Kingdom’s National Cyber Security Centre has advised organisations to prioritise remediation, warning that systems should be taken offline if the vulnerabilities cannot be addressed immediately.
Similarly, the cybersecurity division of the United States National Security Agency has urged organisations using PHP to prepare for updates addressing two critical vulnerabilities.
The agency warned that such weaknesses could provide attackers with a direct route to a server’s file system or database, increasing the risk of unauthorised access and data compromise.
Among the websites reported to be affected are Wikipedia, the BBC, Edinburgh City Council and numerous online retail platforms. The full extent of the impact remains unclear.
Cybersecurity specialists are urging organisations to identify vulnerable systems, apply the relevant security updates as soon as they become available, and take additional protective measures where immediate patching is not possible.
Website operators and businesses are being encouraged to consult official PHP security advisories and guidance from relevant cybersecurity agencies to determine whether their systems are exposed and take appropriate action.
