Worldwide website emergency explained: How a critical PHP weakness sparked a global cybersecurity alert - and exactly what it means for you

A critical weakness has gone unnoticed in the very foundations of the internet for decades, but now AI has triggered a global cybersecurity alert by bringing it to light.

Cybersecurity researchers using AI tools sparked a worldwide website emergency this week by revealing fatal vulnerabilities in the PHP programming language.

This critical open–source system is one of the true building blocks of the modern internet, and is built into millions of websites from Wikipedia to government agencies.

Wiz, one of the companies that discovered the flaw, estimates that '70 per cent of the internet' is affected.

Security agencies and governments have been scrambling to contain the damage since PHP released an update to patch the vulnerability on Wednesday.

However, cybersecurity experts are warning of a wave of hacking attempts in the coming weeks as more details about the vulnerability are made public, putting your private data at risk.

Thai Duong, chief of Calif, one of the companies that found the vulnerability, told the Daily Mail: 'The reality is that there's very little the average internet user can do.

'Should they be concerned? Yes, but there's no need to panic. The responsibility lies with website operators, hosting providers, and the broader security community.'

What is PHP?

PHP, which stands for Hypertext Preprocessor, is a core piece of internet technology that has been used around the world since the early 2000s.

It was one of the very first pieces of 'server–side' web code, and has since become embedded in a vast swath of the modern internet.

Whenever you visit a website, PHP is the piece of software that gathers the information you need and presents it in a way that you can actually read online.

Mr Duong says: 'PHP was one of the first successful dynamic languages designed for the web. 

'As an early mover, it just happens that a lot of popular software in the Internet ecosystem was written in PHP. Some of the biggest Internet websites are written in PHP.'

Since it is free and open–source, meaning it is not operated by a private company, it's particularly popular with governments and universities, since they don't need to rely on a single supplier.

Experts compare finding a flaw in PHP to discovering that a certain type of brick has a safety recall; a lot of infrastructure will be affected, and it's up to the owners themselves to find out where the weakness lies.

What is the PHP vulnerability?

The vulnerability in PHP is absolutely fatal for any unpatched website, since it allows hackers to remotely execute code inside PHP itself.

In simple terms, that means hackers can essentially seize control of any website without needing to guess or steal the passwords.

Mr Duong says: 'Once compromised, attackers could steal sensitive data, modify website content, or disrupt operations. 

'They could also use the compromised websites as a foothold to penetrate deeper into an organization's internal network.'

Likewise, experts warn that criminals can spy on and steal data from affected servers, impersonate and control legitimate websites, infect visitors with malware, edit content on websites, shut down entire sites or lock the owners out, and steal huge amounts of private data.

Shockingly, these weaknesses have been hidden inside the architecture of the internet for years.

Professor Richard Buckland, of the University of New South Wales, says: 'The PHP developers have known about this vulnerability for a long time.

'Two years ago they started to worry about it seriously. Apparently, they initially didn't think it was urgent as they couldn't see how an attacker could make use of the weakness.'

However, the current crisis has come to a head thanks to the work of cybersecurity researchers employing AI tools.

Cybersecurity companies Wiz and Calif worked with ChatGPT maker OpenAI as part of the 'Patch the Planet' project, which is hunting for these exact types of core weaknesses.

OpenAI says that Calif used its cutting–edge AI model, GPT–5.6 Sol, to find two fatal weaknesses in PHP, with Wiz independently finding and verifying the same bugs.

In a blog post, OpenAI said it considers this to be 'one of the most impactful security issues in recent memory'.

Wiz said in a statement: 'With 70 per cent of the Internet affected, the impact of PHP2Shell cannot be overstated.

'It marks an AI inflexion point. The vulnerable code had been there for more than a decade – what AI changed was the ability to understand the weaknesses and turn them into a working exploit.'

What happened after the flaws were revealed?

On Wednesday, developers behind the PHP platform released a new version of the software that includes a fix for the two vulnerabilities.

The responsibility will now fall on individual companies and website operators to ensure that their sites are updated to the latest version of PHP.

National bodies and government cybersecurity agencies have been urging websites to be sure that they are protected or go offline.

The UK's National Cyber Security Centre said: 'Organisations using any version of PHP are affected, and all organisations are highly encouraged to update to the latest fixed version.'

Meanwhile, the American National Security Agency (NSA) wrote in a post on X: 'Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities.

'If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated.'

Even the Japanese Prime Minister, Sanae Takaichi, took to social media to urge people to check their website's security.

Ms Takaichi wrote on X: 'We have an urgent request for everyone to take action tonight.

'If it is difficult to apply the fix patch promptly, temporarily suspending websites and similar measures can be considered an effective way to reduce risk.'

The true scope of the changes will likely become apparent in the coming days, but multiple major sites have already gone down for short periods in preparation.

The Wikimedia Foundation, which runs the online encyclopaedia Wikipedia, took down 'a number of other systems' as a precaution, leaving people unable to access some parts of the site.

The BBC took down sites hosting programmes such as Doctor Who and The Traitors.

Multiple Scottish public organisations have taken their websites down, including councils and health boards across the country.

Meanwhile, major national organisations have also taken the drastic step of taking their sites down, with the Finnish, Australian, and Dutch governments all taking various sites offline.

In the Netherlands, the Dutch Parliament, the Dutch cybersecurity agency, and the public–facing website for the Port of Rotterdam were all taken offline.

Has anyone been hacked?

Currently, it is not clear whether any sites have actually been hacked following the announcement of the flaw.

However, internet service operators are already reporting an increase in hacking attempts, as well as worrying signs that the vulnerability was being used prior to the patch's release.

Matthew Prince, CEO of cybersecurity firm Cloudflare, wrote on X: 'In the 10 hours before it was publicly ​announced, across the network we saw ‌thousands of attempts to exploit it.

'That jumped to tens of ​thousands in the 45 minutes post–announcement, hundreds of thousands within two hours, and millions ​now.'

Dr Junade Ali, cybersecurity expert at the Institution of Engineering and Technology, says: 'These new security vulnerabilities are significant, and there is evidence they are already being exploited. A number of firewall companies have already implemented protections.'

Likewise, Amazon says that the weakness is being 'broadly exploited in the wild' and reported that it had faced attacks using the vulnerability as early as October 17 – four days before the public reveal.

Details of the flaw were then leaked to social media on Tuesday, leading to another attack on Amazon's systems on October 21.

CJ Moses, AWS's chief information security officer, wrote in a blog post that the attack appeared to have been 'conducted by a threat actor, though it remains unclear how the actor acquired exploit information prior to disclosure'.

No one is certain how details of the vulnerability appeared to have become public prior to the announcement, but experts speculate that criminals might have employed AI tools of their own.

Dr Shaanan Cohney, of the University of Melbourne, says: 'AI now makes it far too easy for attackers to find a flaw even when only its existence has been announced and not the details.

'Previously, the window between the announcement of a potential vulnerability and the time it took for a security researcher or hacker to find the specific vulnerability was long enough that one could responsibly put out an announcement.

'AI has changed things, and this means that now the world has to rethink how we handle the disclosure process of vulnerabilities.'

What does this mean for you?

If you operate your own website, it is absolutely critical that you make sure the PHP patch has been applied.

However, even the average internet user needs to be cautious in the coming weeks.

With so many websites affected, experts are anticipating an increase in cybercrime and hacking attempts that could affect your private information.

Jake Moore, global cybersecurity advisor at ESET, told the Daily Mail: 'For people who run their own websites, it is advised to make sure the fix has been applied to any vulnerable sites and to speak to their IT admins to make sure all is secure.

'But for the average internet user, they should use this situation as a reminder that data on websites can very quickly be stolen and that it is important to reduce the amount of sensitive data we hand over.'

Mr Moore recommends using multi–factor authentication, passkeys, and digital pay services rather than handing over card details to websites that might have been compromised.

He also recommends using a guest account when making online purchases to 'reduce the amount of information left on a website that could one day become vulnerable.'

Even if websites do implement the patch, the PHP vulnerability is so deep in the internet architecture that sites may still be vulnerable.

Most websites include multiple software components, plugins, and third–party services which they have very little control over.

If just one of these doesn't patch the PHP weakness, it could lead to the entire network becoming compromised.

Likewise, since PHP is such old software, some website operators may not even know that they have it in their systems.

Professor Buckland says: 'Don't believe everything you read on websites over the next few days or longer. It may be possible for malicious attackers to change wording on sites you trust.

'Wait for government announcements, but in the meantime, you can probably trust that cyber–mature organisations such as banks and telcos have done their patching already. For other websites, perhaps avoid logging into or visiting them for a few days.'