Critical PHP flaws put 22.6 million web systems at risk

The U.S. warning: The NSA, FBI and the Cybersecurity and Infrastructure Security Agency (CISA) urged organizations Wednesday to patch, and to take systems offline if they can't be secured promptly, Nextgov/FCW reported. "If an immediate update is not feasible, it is recommend[ed] that organizations take the system offline," the NSA said, according to PCMag. CISA said it had not seen the flaws exploited as of its posting. A Nextgov/FCW search of the Shodan device index found roughly 900 results tied to U.S. federal, state and local government sites showing signs of PHP use, though it is unclear what versions they run now.

Sites going dark: In Europe, governments pulled sites offline as a precaution. The Dutch national cyber center took its own site down, and so did the Port of Rotterdam, the Overheid.nl government portal and several hospital sites, CNBC reported. Finland's state IT provider took government public network services offline, Denmark's municipal IT company shut a national school platform, and France temporarily took local government administrative sites offline. Wikipedia said it was updating and users might see some disruption, PCMag reported.

Attacks or not: The picture is mixed. Cloudflare's chief technology officer, Dane Knecht, said on X that the company was "seeing early attacks emerging" and called its new firewall rules a "STOPGAP only." CISA and Australia's cyber agency said they had not seen active exploitation, according to Nextgov/FCW and Reuters. CERT-EU said early proof-of-concept attack code was circulating, which "raises the likelihood" that attackers are already exploiting the flaws.

The AI angle: OpenAI said security firm Calif found one of the critical flaws using its GPT-5.6 Sol model, and security company Wiz independently found and reported both, Nextgov/FCW reported. Wiz said it showed working attacks against WordPress, Drupal and Joomla sites and called the flaws among "the most severe vulnerabilities discovered in PHP," adding that the bad code had been there for more than a decade, according to PCMag. A Hacker News post leaked details on Tuesday, pushing the fix out a day early and leaving site owners little time to prepare, Nextgov/FCW said.

If you run a website: Wordfence, a WordPress security plugin maker, warned that WordPress's automatic updates will not apply this fix, because PHP sits on the server underneath the site, CNBC reported. Owners on shared hosting should ask their host whether PHP has been updated. Versions 8.1 and older get no official release; CERT-EU says to check with a Linux or long-term-support vendor for backported fixes, or upgrade. The PHP team rates setups using Apache's mod_php as the highest risk.

What's still unknown: How many sites have actually been broken into, whether any U.S. government systems were hit, and how quickly millions of small sites on shared hosting will be patched. Flaw details are now public, which security experts quoted by CNBC say could speed up mass scanning by attackers.

This is a breaking story. Fix versions and technical details come from the PHP project's release notes and CERT-EU's advisory; the U.S. agency warning and vulnerable-system count follow Nextgov/FCW, and the NSA quote follows PCMag. The 22.6 million figure is Palo Alto Networks Unit 42's count of potentially vulnerable internet-exposed instances, not confirmed breaches. Reports differ on whether attacks have begun: Cloudflare reports early attacks; CISA said it had not observed exploitation. Hero photo shows NSA headquarters in 2013 (file photo).