What Is PHP, and Why Did a Flaw in It Trigger a Global Alert?

PHP is the programming language that quietly assembles much of the web a person sees every day — including Wikipedia and sites built on WordPress — and on Wednesday, researchers using artificial intelligence disclosed flaws in it serious enough to prompt governments and companies worldwide to patch systems or take them offline, according to the BBC.

Cyber-security firm Wiz, one of the companies whose researchers uncovered the vulnerabilities, called them the "most severe" ever detected by AI, the BBC reported. OpenAI, whose technology was used in the discovery, described it as "one of the most impactful security issues in recent memory."

What exactly is PHP?

PHP — short for PHP: Hypertext Preprocessor — is the code that runs behind the scenes on a huge share of the internet's websites, from online shops to government portals. Paul Spain, chief executive of Gorilla Cyber Security, told the BBC that when someone visits a site like Wikipedia, "PHP is the code that collects information you need and presents it in a way you can read on the web." It has been in wide use since the 2000s, and WordPress, the content management system behind countless blogs and small-business sites, runs on it as well.

What is the flaw, and how bad is it?

The BBC reports the flaw could let attackers take control of affected web servers without authentication and steal sensitive data — meaning anything built on PHP was potentially exposed. Spain told the BBC that AI could make such attacks "easier and faster," and estimated the flaw could affect "millions and millions" of websites. Cyber-security researcher Jill Slay of the University of Adelaide said it would be "disastrous" if hackers or countries weaponized the flaw to seize private data from websites.

"One of the most impactful security issues in recent memory." — OpenAI, quoted by the BBC

Which websites and governments have been hit?

The disruption stretched across sectors and borders on Wednesday, according to the BBC. Wikimedia, the organization behind Wikipedia, took down a number of its systems as a precaution. The Finnish government, Edinburgh council and the BBC itself pulled sites or pages offline, and the Netherlands' national cyber-security agency took down its own website. A number of Scotland's public bodies, including councils and health boards, also went offline, the BBC reported, and the University of Geneva's site was among those taken down, per images cited by the BBC via EPA.

By the numbers

• More than a decade: how long the flaws reportedly sat undetected in PHP before AI-assisted research surfaced them, per the BBC.
• "Millions and millions": Paul Spain's estimate, cited by the BBC, of how many websites could be affected by the flaw.

How did AI find flaws that humans missed for years?

The BBC's reporting credits the discovery to Wiz researchers using OpenAI's technology, framing it as a case where AI tools surfaced patterns in code that had escaped conventional security review since PHP's widespread adoption in the 2000s. The companies involved did not characterize the exact technical method beyond calling the find among the most severe AI has ever surfaced, according to the BBC, and cyber-security researcher Salil Kanhere of UNSW Sydney warned that more attempts to exploit the flaws are likely now that technical details are public.

What are PHP's developers and governments doing about it?

Developers of the PHP platform rolled out patches on Wednesday to address the vulnerabilities, the BBC reported, with the company stating: "All PHP users are strongly encouraged to update immediately." Authorities and security agencies in multiple countries urged website operators either to apply the emergency fix without delay or to consider taking affected platforms offline until they could confirm they were secure. Smaller organizations with limited security staff and budgets are at particular risk, experts told the BBC, because they are less likely to have the resources to patch quickly or monitor for exploitation attempts in the weeks ahead.

What should site owners and everyday users do now?

For anyone running a PHP-based site — a WordPress blog, a small online shop, a community forum — the practical advice from the sources cited by the BBC is straightforward: update PHP immediately using the patch released Wednesday, and if that is not immediately possible, take the affected system offline rather than leave it exposed. For ordinary users, the BBC's reporting does not indicate a direct action is required, since the exposure sits at the server level rather than in individual browsers or devices; the risk is that personal data held by an affected site's operator — a government portal, a retailer, a reference site like Wikipedia — could be exposed if that operator has not yet patched. The full scope of exploitation, if any, had not been detailed in the BBC's reporting as of publication.