State portals and digital public services faced widespread outages following warnings over a flaw in PHP code that lets hackers commandeer unpatched servers.
The PHP Foundation admitted that internal hesitation and scarce resources stalled a patch for a severe security weakness initially spotted in 2024, labeling the sluggish response a “structural failure.”
Public institutions and global enterprises pulled their web portals offline Wednesday as a safety measure while PHP developers rushed out urgent fixes for a pair of dangerous, interconnected security gaps that let unauthorized hackers run malicious code on exposed servers without credentials.
As a widely used programming language, PHP powers millions of websites and web applications, including major content management platforms.
In a blog post published alongside the hotfix, the team detailed how engineers initially spotted traces of the flaw back in 2024, yet fought to craft a fix that wouldn’t break the vast network of software relying on PHP.
“Combined with the lack of a known path to remote code execution and the small team of core developers with the necessary deep knowledge of the engine occupied with many responsibilities, this decision process caused work on a fix to stall and restart repeatedly over months,” said the foundation.
“We won’t pretend otherwise: the delay was a structural failure, caused by both the security team’s decision process and its lack of resources.”
Security analysts at Calif and OpenAI separately flagged the identical core flaw on August 11, drawing renewed attention to the issue after Calif proved full remote code execution and pushed the threat to the top of the developers’ priority list.
Websites Shut Down as PHP Security Fears Escalate
Global outages spread rapidly as system administrators pulled portals offline while readying emergency security updates for installation.
Dutch authorities suspended the nation’s digital identity system, while officials at the National Cyber Security Centre also pulled their main portal offline.
Finland’s state tech agency Valtori suspended public civic portals, and French Interior Ministry officials temporarily disabled regional administrative sites. German federal IT authority ITZBund likewise took several government domains offline, Reuters reported.
Australian Signals Directorate officials confirmed that their official cybersecurity hub, cyber.gov.au, was among the public portals impacted by the PHP flaw.
Japanese Prime Minister Sanae Takaichi posted on X advising web administrators to get ready to deploy the update without delay. She noted that taking web features offline temporarily might curb exposure if the fix couldn’t be installed right away.
The Wikimedia Foundation, operator of Wikipedia, temporarily suspended secondary systems including Toolforge and Cloud VPS—hubs for volunteer developer projects—causing partial outages across Wikipedia on Wednesday as a preventive measure.
Crypto security firm SlowMist scanned Web3 infrastructure using its MistEye scanner, prompting exchanges, DeFi protocols, and wallet services to check their exposure and patch immediately. Analysts detected explicit PHP signatures on 793 of the 1,488 domains evaluated.
Intersect, an entity backing Cardano’s growth and governance, suspended its Members Area to gauge potential risk, with the portal remaining inaccessible at publication time.
Coinbase security chief Jeff Lunglhofer stated that investigators uncovered no trace of vulnerable PHP deployments across company systems.
“Whenever we hear about vulnerabilities like this, we automatically conduct a full sweep to make sure everything is as safe as we can make it. We’re also working with our third party suppliers for extra assurance.”
Digital asset infrastructure firm BitGo confirmed that its platform suffered no impact from the PHP flaw.
Binance co-founder Changpeng Zhao cautioned internet users Wednesday to exercise heightened caution on the web over coming days, noting that many site administrators may lag behind on critical security updates.
OpenAI published a Codex utility on GitHub to assist web administrators in scanning for at-risk PHP installations and pinpointing appropriate patches.
PHP security maintainers stated that researchers found no working exploits at the time of the public advisory.
