Updated 2m ago · Tech
Governments Pull Websites Offline Over Critical PHP Flaw
PHP developers said Wednesday they would release patches for two critical vulnerabilities. Cyber agencies told organizations unable to patch to consider taking affected sites offline.
- 9.2 out of 10: the severity rating PHP gave both flaws.
- 1.3 million-plus internet-connected hosts are likely affected, one researcher estimated.
- watchTowr says every version from PHP 5 onward is affected.
- Cloudflare says early attacks are already emerging against PHP sites.
Why it matters: The flaws allow remote code execution, according to CERT-EU. Attackers could run their own code on servers without logging in.
- GoDaddy warned of data theft, website defacement or full system compromise.
- Wordfence says every WordPress site runs on PHP and is exposed.
How 42 sources split on this story
Source landscape
Factuality
High
Mixed
Low
Strong LeftLeftLean LeftCenterLean RightRightStrong Right
Political Bias
Coverage by lean
42 sources · 60 articles · 45% Center coverage
Where they split: Coverage differs on whether attacks have begun: Cloudflare reports early attacks, while Australia's cyber agency said it knew of no active exploitation.
Center coverage, 19 sources: The center pairs the PHP flaws with a separate eMudhra certificate compromise, framing a broader day of web security strain.
Engadget2hGovernment Websites In The EU And Canada Taken Offline Over PHP VulnerabilityCTV News4hSTM, SAQ websites down in wake of worldwide security breachReuters7hWhat is PHP and why did it take government websites offline?USA Today55mA basic explanation of the 'critical' PHP flawAssociated Press4hSome websites go dark as operators address an AI-detected flaw in a web programming languageAxios1hAI uncovers massive flaw in web's foundational codeBBC News11hPHP cyber-security warning sees sites taken down across EuropeBloomberg11hGovernments Take Websites Offline After PHP Security WarningsCNET8hPHP Vulnerabilities Could Put Much of the Internet at Risk, Experts Warn - CNETDefense One6hCritical flaws in ubiquitous website software draw urgent warning from NSA, FBIDeutsche Welle6hPHP developers say key patches available after global security scare sends agencies scramblingFortune4hAI helped discover the PHP vulnerability that could take down 70% of the Internet. Now the race is on to patch it before AI-powered hackers attack | FortuneIBTimes5hWebsites are Racing to Patch Software Powering Up to 70% of the Web as AI Uncovers Critical FlawsJerusalem Post6hGovernment websites go dark as vulnerabilities in programming language send shudder across internetNews4Jax5hSome websites go dark as operators address an AI-detected flaw in a web programming languageNewsweek4hPHP vulnerability sparks scramble as major websites face threatSemafor11mAI helps find vulnerability affecting up to 70% of websitesSky News9hWebsites warned to install critical PHP software update or go offlineThe National Desk3hCritical PHP flaws put millions of websites at risk as governments pull sites offline
Left coverage, 13 sources: The left frames the story around the risk of websites going down and agency warnings to pull sites offline.
The Independent5hSome websites go dark as operators address an AI-detected flaw in a web programming languageThe Verge2hPHP: The three letters that shut down sites all over the internet todayTechCrunch4hThe internet is having a very bad cybersecurity day | TechCrunchABC News7hUrgent security fix issued for code vital to estimated 70% of all websitesBusiness Insider6hA major security flaw found using ChatGPT is causing internet chaosCNN6hAI helped find a critical security flaw affecting 70% of the internetGizmodo7h‘Expect Mass Attacks Within 15 Minutes’: Hackers Poised to Exploit Newly Discovered Website FlawsLos Angeles Times3hSome websites go dark as operators address an AI-detected flaw in a web programming languageMother Jones2hAI helped find a critical bug affecting huge swathes of the internetNBC News10hCritical vulnerabilities in commonly used web code spark rush to update systemsPolitico7hUS, allies warn of critical vulnerabilities in programming underlying 70% of the internetThe Boston Globe5hSome websites go dark as operators address an AI-detected flaw in a common web programming languageThe Guardian5hFlaw in PHP computer language leads to shutdown of websites around world
Right10 sources
Daily Mail17mMajor Australian websites go down due to critical security flawThe Epoch Times23hWarning Issued on Vulnerability That Puts Two-Thirds of All Websites at RiskJust the News23hNSA Cyber division urges organizations to patch security flaws identified by AINational Post4hFeds pull multiple government websites after critical vulnerability uncovered by AINew York Post5hMajor websites in US and Europe go dark as operators race to protect systems from hackersNewsmax3hFBI Warns of Critical Flaws Affecting PHP WebsitesNTD3hWarning Issued on Vulnerability That Puts Two-Thirds of All Websites at RiskThe Blaze4hMost of the internet is suddenly melting down, and there's only one fixThe Sun8hWebsites taken down across UK including The Traitors, Met Police & dozens of councils in ‘critical’ PHP security glitchThe Washington Times2hGovernment websites in Europe go offline as companies update software flaw
What’s next: The patch was set for 14:00 UTC Wednesday. PHP said it would release earlier if details leaked or exploits appeared.
- Sansec expects mass attacks within 15 minutes of the release.
- PHP will publish affected versions and flaw details once patches ship.
- Which PHP versions are affected? PHP itself has not confirmed.
- How many sites will go offline rather than patch in time?
4h ago
19 sources, 4h
View all