The reported flaws could allow cybercriminals to take control of vulnerable servers without passwords or other authentication credentials, raising concerns about the security of essential digital services and sensitive information.
According to the original report, PHP developers have released emergency security patches and urged website administrators to install the updates immediately. The warning has attracted international attention because PHP supports a substantial proportion of websites, including government portals, online marketplaces, news platforms and content management systems.
Cloud security company Wiz estimates that approximately 70 per cent of websites worldwide use PHP. The company has reportedly described the vulnerabilities as among the most serious security weaknesses identified in the programming language’s history.
The potential consequences could extend beyond temporary website disruption. Depending on the nature of the vulnerabilities and the configuration of affected servers, attackers might gain unauthorised access to confidential databases, modify application files or interfere with essential online services.
Security Concerns Compared With Heartbleed Crisis
Volker Dusch, identified in the report as a security engineer associated with the PHP Foundation, reportedly told The Wall Street Journal that the vulnerabilities represented the most serious security challenge facing PHP in more than a decade.
He drew comparisons with Heartbleed, the major security vulnerability discovered in 2014 that affected OpenSSL, a widely used cryptographic software library.
The Heartbleed incident exposed weaknesses in systems responsible for securing internet communications, prompting organisations worldwide to update vulnerable software and strengthen their security arrangements.
The comparison reflects concerns about the possible scale of the newly reported PHP vulnerabilities, particularly because the programming language is deeply embedded in modern digital infrastructure.
The United States National Security Agency (NSA) has also reportedly issued an urgent warning through social media platform X, advising organisations to update vulnerable systems without delay.
According to the report, the agency recommended disconnecting affected servers from the internet if immediate installation of security patches was not possible.
Such measures are intended to reduce the risk of unauthorised access while technical teams assess affected systems and implement appropriate safeguards.
If attackers successfully exploit a serious server vulnerability, they could potentially access databases, application files and other sensitive resources, depending on the permissions available to the compromised software.
Artificial Intelligence Reportedly Helped Discover the Flaws
The original report claims that the vulnerabilities were first identified in August during an artificial intelligence-assisted examination of PHP’s source code.
A cybersecurity organisation identified as Calif reportedly discovered the weaknesses while conducting research funded by OpenAI. The investigation allegedly involved an AI model referred to as GPT-5.6 Sol.
The report further claims that Google-owned cybersecurity company Wiz independently identified the same vulnerabilities using artificial intelligence systems described as Gemini 4 Argon and GPT-5.6 Sol.
OpenAI was subsequently reported to have highlighted the findings in a post on X, presenting the discovery as evidence that advanced artificial intelligence systems could identify significant structural weaknesses in widely deployed software.
However, the claims concerning the researchers, model names and circumstances of the discovery have not been independently verified.
Artificial intelligence is increasingly being explored as a tool for analysing software code, identifying possible security weaknesses and assisting researchers with complex technical investigations.
These systems can help examine extensive codebases and highlight potentially dangerous patterns. Their findings still require careful technical assessment to establish whether a suspected vulnerability is genuine and exploitable.
European Governments Reportedly Suspend Digital Services
The reported security concerns have prompted precautionary measures in several European countries.
France’s Interior Ministry has reportedly suspended access to several government websites following advice from national cybersecurity authorities.
The affected services are said to include websites operated by the Paris police and various local administrative bodies.
The temporary shutdowns were reportedly introduced to minimise potential exposure while security teams assessed the risks associated with the vulnerabilities.
In the Netherlands, national broadcaster NOS reportedly stated that several important government platforms had been taken offline as a precaution.
These allegedly included DigiD, the country’s digital identity verification service, alongside websites associated with the Dutch parliament and the National Cyber Security Centre.
DigiD plays an important role in allowing residents to access government services and other participating organisations securely. Interruptions to such systems can affect people who depend on digital identity verification for routine administrative activities.
Belgium’s Foreign Ministry has also reportedly suspended access to its official online portal as part of precautionary security arrangements.
The reported shutdowns illustrate the disruption that serious software vulnerabilities can cause when widely used technologies support essential public services.
Australian Cybersecurity Portal Also Reportedly Affected
Concerns have extended beyond Europe, with Australia’s cybersecurity infrastructure also mentioned among potentially affected services.
According to information attributed to the Australian Broadcasting Corporation, the official cybersecurity portal associated with the Australian Signals Directorate was among the websites potentially exposed to the PHP vulnerabilities.
The Australian Signals Directorate plays a significant role in the country’s national cybersecurity framework, including providing guidance to organisations seeking to strengthen their protection against digital threats.
The reported inclusion of its cybersecurity portal has raised questions about the potential reach of the vulnerabilities.
However, a website being identified as potentially vulnerable does not necessarily mean that attackers have successfully compromised it.
Similarly, temporarily taking a website offline may be a preventive decision rather than evidence of an actual cyberattack.
Determining whether a system has been compromised requires technical investigation, including examination of server activity, access records and other relevant security evidence.
Software Updates Remain Essential to Cybersecurity
The reported incident highlights the importance of maintaining updated software across digital infrastructure.
Security patches are designed to correct identified weaknesses, reducing opportunities for attackers seeking to exploit vulnerable systems.
For organisations operating PHP-based services, the appropriate response depends on the precise vulnerabilities involved, the software versions in use and the configuration of their servers.
Cybersecurity specialists generally recommend maintaining supported software versions, restricting unnecessary access privileges, monitoring suspicious activity and keeping reliable backups of important information.
Government agencies and organisations handling financial or personal data face particularly serious consequences if their systems are compromised.
A successful intrusion could potentially expose confidential records, interrupt public services or undermine confidence in the security of digital platforms.
The reported discovery also reflects the growing role of artificial intelligence in cybersecurity research. Although advanced tools may accelerate the identification of weaknesses, effective protection ultimately depends on accurate technical assessment and timely corrective action.
Important details surrounding the reported incident remain unverified. The source article does not identify the two vulnerabilities by their Common Vulnerabilities and Exposures (CVE) numbers, specify the affected PHP versions or provide details of the alleged emergency security releases.
The reported government website shutdowns, official warnings and AI-assisted discoveries have not been independently confirmed either.
Until authoritative technical advisories and official statements establish those details, the full scale of the reported threat and the number of genuinely affected websites remain uncertain.
