Critical PHP flaws prompt EU and US warnings, European sites go offline
In short
Two security vulnerabilities in the PHP programming language, each rated 9.2 out of 10, let attackers run code on servers without logging in. PHP released fixes on 21 October, a day earlier than planned, while EU and US authorities urged operators to update or take sites offline and some European government sites were blocked.
Read the full story 3 min read
A critical security vulnerability in the programming language PHP prompted alerts in several countries, Korean outlets reported on 21 and 22 October. PHP said it would release security patches for two vulnerabilities at 11 pm Korean time on 21 October. It said both were rated 9.2 out of 10 on the CVSS v4.0 standard and strongly urged users to upgrade as soon as the patches were out. Chosun Ilbo reported that the developers released an emergency fix on 21 October local time. [ 1 , 2 , 3 , 7 , 9 ]
The flaws, called PHP2Shell, allow commands to be run on a server without an account or password, according to AI Times. The EU cybersecurity authority said in an advisory issued on 20 October that the score signals unauthenticated remote code execution. Web hosting company GoDaddy warned that this can lead to data theft, website defacement or full takeover of a system. CERT-EU said users should be ready to upgrade at once and consider taking websites offline if the patch cannot be applied, Reuters reported. [ 1 , 9 ]
In the United States, the National Security Agency said on X that all agencies and companies using PHP should prepare to update and, if they cannot do so immediately, take systems offline until the vulnerability is fully resolved, Asia Economy reported, citing the Wall Street Journal. The FBI also urged operators who cannot update at once to take websites offline. AI Times said the US government was helping federal agencies and key infrastructure apply the patch with technology companies. [ 6 , 9 , 10 ]
In Europe, sites were taken offline as a precaution. AI Times reported that in the Netherlands the government portal, the Port of Rotterdam, the football association, major political parties and several hospitals were affected. More than 100 municipalities, provincial governments and water authorities that use one software provider's service were also affected, citing the news agency ANP. Denmark, Finland, Germany and France temporarily blocked government sites. Germany and Finland called the steps preventive, and Finland said it was not responding to exploitation attempts or a data leak. Asia Economy added Belgium and the Czech Republic. [ 9 , 10 ]
According to AI Times, Calif used OpenAI's GPT-5.6 Sol to find the flaw and reported it in August. Wiz, a unit of Alphabet according to AI Times, confirmed it independently with its own AI tools, Google's Gemini 4 Argon and GPT-5.6 Sol. Wiz said the flaw had been in PHP code for more than ten years. A Wiz co-founder told the Wall Street Journal that it was the most serious vulnerability found by AI to date. The PHP Foundation said it saw signs of one flaw in 2024 but could not identify an attack path, and called this a structural failure. [ 7 , 9 ]
PHP developers brought the release forward by a day after details of the flaws leaked online. Reuters reported concern that hackers could use AI to analyse the fix and quickly work out attack methods before updates are finished. Cloudflare said it observed some early attempts, while CISA had not confirmed exploitation at the time of AI Times' report. Chosun Ilbo reported that ordinary users need not install anything, and that PHP developers said changing some settings alone cannot fully solve the problem. [ 7 , 9 ]
Why it matters
PHP is used by about 70% of websites whose server language can be identified, according to AI Times, so one flaw can expose many sites at once. Outlets say the fix itself may help attackers, which makes how fast operators update important.
Key facts
- PHP said it would release security patches for two vulnerabilities at 11 pm Korean time on 21 October; both were rated 9.2 out of 10 on the CVSS v4.0 scale. [ 1 ]
- The flaws, called PHP2Shell, allow commands to be run on a server without an account or password, AI Times reported. [ 9 ]
- CERT-EU and the EU cybersecurity authority urged preparing to upgrade at once and taking vulnerable sites offline if the update cannot be applied. [ 1 ]
- The US National Security Agency and the FBI urged operators who cannot update immediately to take systems offline, Asia Economy reported, citing the Wall Street Journal. [ 10 ]
- Government and other websites in the Netherlands, Denmark, Finland, Germany and France were taken offline or blocked, AI Times reported. [ 9 ]
- Security firm Calif found the flaw using OpenAI's GPT-5.6 Sol and reported it to the developers; Wiz, a Google-affiliated security firm, found it separately. [ 7 , 9 ]
- PHP developers brought the release forward from 22 October to 21 October after information about the flaws leaked online. [ 7 , 9 , 10 ]
Confirmed by several sources
- PHP developers released a security fix on 21 October, a day ahead of the planned 22 October date. [ 7 , 9 , 10 ]
- The flaw lets an attacker run malicious code on a server without logging in. [ 1 , 7 , 9 , 10 ]
- EU and US authorities urged operators who cannot update at once to take affected systems offline. [ 1 , 6 , 10 ]
- Some European government websites were taken offline or blocked as a precaution while updates were applied. [ 4 , 7 , 9 , 10 ]
- Calif found the flaw with OpenAI's GPT-5.6 Sol, and Wiz found it independently. [ 7 , 9 , 10 ]
Still unclear
- What share of websites use PHP. Yonhap pieces give 'up to 70%', 'more than 70%' and 'more than 75%'; AI Times says about 70% of sites whose server-side language can be identified; Asia Economy says 70%.
- Whether the flaws are being exploited and how much damage has been done. Cloudflare said it observed some early attempts and Asia Economy reported some hacking attempts, but CISA had not confirmed exploitation when AI Times reported, and AI Times says the scale of any intrusions or data leaks is not yet confirmed.
- The technical cause of the flaw. Chosun Ilbo describes it as an error when PHP processes a visitor's request; Asia Economy says it arises in PHP's memory handling.
- How the information leaked before the planned release. Chosun Ilbo, citing SecurityWeek, says information appeared online on 20 October; AI Times says details and an attack demonstration video were published early; a Yonhap headline mentions a dispute over a patch leak involving some distributors, with no details in the documents.
What local media are saying
Timeline, local time
- Yonhap reported the EU alert and CERT-EU advice to be ready to upgrade or take sites offline. [ 1 ]
- Korean time at which PHP said it would release patches for the two vulnerabilities. [ 1 ]
- Yonhap reported that major European public institutions had blocked access. [ 4 ]
- Yonhap reported that the US urged operators to go offline if they could not update at once. [ 6 ]
- Chosun Ilbo reported that PHP developers had released an emergency fix on 21 October local time. [ 7 ]