Two critical security flaws in PHP have triggered emergency updates and temporary service shutdowns worldwide. The popular programming language powers millions of websites. In Colombia, the national cybersecurity response team issued an alert regarding PHP’s widespread use in internet-facing services, while an independent investigation identified potential weaknesses in government-related servers.
The flaws could allow attackers to send instructions to a vulnerable server without logging in. Depending on its configuration, a successful attack could expose information, alter website content or provide access to other resources.
Colombia’s cybersecurity alert identifies 8,699 internet-facing services using PHP. This figure does not mean that all those services are vulnerable or belong to government institutions, but it shows the scale of the review facing organizations that use the language.
Why a PHP flaw can affect so many websites
PHP works behind the scenes to help websites display content, process requests and communicate with databases. It supports widely used platforms such as WordPress, Drupal and Joomla, as well as custom websites and online services.
Most visitors never interact with PHP directly; they see the website or service that relies on it. A weakness in PHP can therefore affect sites with different designs and purposes, even when their owners use different applications.
The flaws are considered critical because attackers may exploit them remotely without an account or password. Security specialists call this remote code execution: an attacker can make a vulnerable server run commands of their choosing.
The vulnerabilities received scores of 9.2 out of 10 on the scale cybersecurity specialists use to assess software flaws. That rating places them in the critical category; it does not mean there is a 92% chance of an attack or that 92% of websites are vulnerable.
The PHP team released corrected versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Organizations running affected installations should apply the relevant update. Older versions that no longer receive fixes may require a broader upgrade or assistance from the software maintainer.
What Colombia’s cybersecurity figures reveal
ColCERT, Colombia’s Cyber Emergency Response Team, issued the alert on Oct. 21. According to a report by Colombian technology outlet Impacto TIC, the team identified 8,699 internet-facing services using PHP through data from Shodan, a search engine that indexes devices and services connected to the internet.
¿Por qué es tan grave?
— Impacto TIC (@ImpactoTIC) October 21, 2026PHP está en el 69,3 % de los sitios web con lenguaje identificable. Sobre él corre WordPress, presente en el 39,6 % de la web. Quien explote la falla accede a bases de datos, credenciales y archivos. El FBI y CISA piden desconectar lo que no se actualice.
The figure counts services identified through their internet connections, not confirmed vulnerable websites. It also does not identify every service owner: a server may operate through a hosting company while supporting a separate public or private institution.
An investigation by cybersecurity outlet MuchoHacker focused on government-related domains ending in .gov.co. Searches through Shodan and Censys identified approximately 170 server records associated with those domains that advertised PHP.
MuchoHacker then examined 20 records from one set of results. Nineteen disclosed their PHP version. The investigation reported that 18 used versions no longer supported by the PHP project, while the remaining server ran PHP 8.2 without the newly released update.
Because the sample was small and not randomly selected, it cannot establish what proportion of Colombia’s government websites is affected. Some software vendors also apply security fixes without changing the version number visible to outside observers.
The investigation did not confirm a successful attack against a Colombian government institution using these flaws. The immediate unanswered questions are which identified systems remain exposed and whether any have already been compromised.
Shutdowns and urgent updates worldwide
The risks have led organizations in several countries to restrict access to online services while their technical teams investigate and install fixes.
In Europe, government, school and hospital websites were among the services temporarily taken offline as a precaution. In Japan, companies and public institutions, including financial and transport organizations, suspended some online services while assessing their exposure. Finland’s state IT services provider also began restoring services after applying updates and testing systems.
Taking a website offline can reduce immediate risk, but it can disrupt access to public information, banking, transportation and government services. Administrators must test systems before restoring access to ensure that services work correctly and have the necessary protections.
Cloudflare CEO Matthew Prince described a rapid increase in attempted exploitation after the flaws became public. The company observed thousands of attempts before the public announcement, followed by tens of thousands within 45 minutes, hundreds of thousands within two hours and millions thereafter.
Those figures show how quickly attackers began targeting the flaws. They do not establish how many attempts succeeded or whether Colombian systems were among the targets.
How artificial intelligence enters the story
Artificial intelligence helped researchers uncover the PHP flaws, according to reports on the discovery. The technology can help specialists examine large amounts of code and identify weaknesses that might otherwise take longer to find.
The same capabilities could help attackers develop or adapt methods to exploit a newly disclosed flaw. The risk rises when technical details become public and organizations have not yet updated their systems.
The rapid rise in attempted attacks reported by Cloudflare illustrates how little time organizations may have to respond after a serious vulnerability becomes public. The available figures do not establish whether individual attacks used AI.
What needs to happen next in Colombia
ColCERT’s alert and MuchoHacker’s investigation offer different views of potential exposure: one estimates the number of internet-facing PHP services across Colombia, while the other examines a small sample of government-related servers. Neither provides a comprehensive assessment of the country’s vulnerable systems.
Institutions and service providers must immediately identify their PHP installations, apply the necessary updates, and check for signs of compromise. Where a service cannot be secured promptly, administrators may need to restrict public access until the problem is addressed.
Until the organizations responsible verify the status of the identified systems, the number of Colombian government servers still at risk—and whether any have been successfully attacked—remains unknown.