A critical vulnerability in a fundamental component of the internet’s infrastructure was revealed this week, prompting website administrators globally to rush to implement necessary fixes.
The issue was found in the PHP programming language — a widely utilized software deemed “the backbone of the internet,” as stated by Isaac Privett, a senior penetration tester with the Toronto cybersecurity firm Packetlabs.
This vulnerability had existed for several years, potentially enabling malicious actors to infiltrate websites, modify them, and steal sensitive data.
This situation led many to take their sites offline while they applied patches, resulting in some websites — including those of the Canadian government — becoming inaccessible.
Here’s what you should understand about the PHP language, how this vulnerability was uncovered, and its potential severity.
What is PHP?
PHP is an open-source programming language, meaning it can be downloaded and used for free by anyone, and it is extensively utilized across the internet. The technology is overseen by the non-profit PHP Foundation, which comprises a volunteer board and a small group of developers.
When visiting a website, various elements like images, hyperlinks, and color schemes must be compiled and displayed accurately for users, according to technology analyst Carmi Levy. PHP handles this task by integrating these components and creating dynamic websites.
“PHP operates quietly in the background to ensure that fragmented data stored on a server is transformed into an interactive website you can view on your device,” explained Levy, who is located in London, Ontario.
A security breach in the foundational PHP code that supports much of the internet has triggered a global alert, leading governments and major corporations to take websites offline. Andrew Chang details how advanced AI identified the vulnerability — and the ongoing struggle between defenders and hackers to secure the system. (Photo credits: The Canadian Press, Reuters, Adobe Stock and Getty Images)
Wiz, one of the cybersecurity companies involved in identifying this flaw, estimates around 70% of websites utilize PHP, while web technology tracker W3Techs places that figure at about 75%.
This extensive use establishes PHP as a “foundational” technology crucial for the internet’s operations, according to Levy, highlighting why a vulnerability within it can lead to far-reaching consequences.
What is the issue, and how was it discovered?
A collaboration of researchers from the cybersecurity firms Calif and Wiz disclosed on Wednesday that they had identified two vulnerabilities within PHP. They had been operating as part of an OpenAI program designed to identify potential weaknesses across the internet, including within PHP.
Ryan Austin, a cybersecurity researcher at Calif.io, who assisted in uncovering these issues, noted that he was aware of a 2004 security vulnerability in PHP and utilized OpenAI’s GPT‑5.6 Sol to investigate the same section of PHP’s code for additional flaws.
“Then, just a few days later, we were able to identify something quite serious,” Austin recounted.
The PHP Foundation explained in a Wednesday announcement that both vulnerabilities are located in “areas of PHP that nearly every request interacts with: memory management and error handling.”
Austin clarified that when PHP encounters an error, it retains memory details that can be compromised, potentially providing hackers a pathway into websites.
Tech analyst Carmi Levy emphasizes that the extensive use of PHP across the internet is a significant factor in the seriousness of a vulnerability within it. (Submitted by Carmi Levy)
If hackers were to exploit this entry point, they could modify websites — potentially injecting malware or deleting content — or access sensitive information such as passwords, according to Levy.
Wiz reported that these vulnerabilities had been present for over a decade. The PHP Foundation acknowledged that a researcher had speculated about this possible exploit in 2024, but no actionable method to execute it was discovered at that time.
The PHP Foundation stated that the delay in addressing the issue was a “structural failure” resulting from resource inadequacies and the security team’s decision-making process.
How serious is it?
Levy compared the situation to a scenario where a leading manufacturer of door locks discovers that a master key is readily accessible.
<p"This means someone could simply approach your front door, insert that master key, and gain entry into your home," Levy noted.
He elaborated that security incidents are evaluated on a scale from zero to 10, utilizing something known as the Common Vulnerability Scoring System. These vulnerabilities scored a 9.2, indicating their severity.
Government and corporate websites around the globe were taken offline following the discovery of vulnerabilities in the popular PHP code that could expose them to numerous hackers.
“A single vulnerability in a technology used by nearly everyone suggests a potential global impact,” Levy stated.
From Austin’s standpoint, this is “likely one of the most severe vulnerabilities I’ve ever encountered.”
How is it being resolved?
Cybersecurity professionals report that the positive news is that a solution is available.
The PHP Foundation issued patches for the vulnerability on Wednesday and urged users to apply the fix promptly.
Cybersecurity agencies and government officials worldwide, including those in Canada, echoed this recommendation.
A developer works on PHP code at RK Solutions software development firm in Guernica, Spain, on Thursday. (Vincent West/Reuters)
Numerous websites, including those of the governments of Canada, France, and Japan, temporarily went offline while addressing the security concern. For instance, provincial websites for Newfoundland and Labrador and Prince Edward Island were offline for the day but appeared to be operational again by Thursday.
The U.S. National Security Agency’s cyber division advised any organizations unable to apply the fix immediately to take their websites offline until the patch could be deployed.
Although the temporary shutdown of websites caused some alarm, Levy believes there is a positive aspect to the situation. The proactive measure of taking sites down occurred after researchers identified a vulnerability before it could be exploited by hackers, showcasing the effectiveness of the system in flagging such issues.
The Newfoundland and Labrador government website was taken offline on Wednesday after the PHP vulnerabilities were made public. (CBC)
Some websites experienced hacking attempts following the disclosure of the vulnerability, but these efforts did not seem to succeed. For instance, Cloudflare’s CEO reported on social media that their network encountered tens of thousands of attempts to exploit the flaw within 45 minutes of the announcement, and “hundreds of thousands” in the subsequent two hours.
On Wednesday, the PHP Foundation informed CBC News via email that there was no evidence indicating hackers had successfully exploited the vulnerability.
Should I take action?
Cybersecurity specialists advise that since the issue pertains to the backend of websites, it primarily falls on those managing them — such as businesses or organizations — to ensure the fix is applied.
This process is relatively straightforward for website operators in most cases, akin to updating a personal computer, according to Privett from Packetlabs.
“You simply need to upgrade to the latest version of PHP, which resolves about 99% of your issues,” Privett stated.
A new EY report suggests AI will become a major force behind cybercrime in 2026 as programs help attackers hone their scamming skills.
However, given the public disclosure of both the vulnerability and the fix, Privett emphasizes that website owners must remain vigilant for signs of possible breaches that may have occurred before they applied the patches.
“After you implement the patch, it’s advisable to check for any indicators of compromise, in case someone exploited that bug to gain access to your system,” Privett cautioned.
Privett also encourages individuals who own websites or applications to verify whether they utilize PHP to ensure their protection.
For all users, Levy advises that they can enhance their defenses against potential data breaches by strengthening their personal digital security measures. Maintaining good password practices — such as frequently changing passwords and avoiding reuse — as well as enabling two-factor authentication can help protect against unauthorized use of data in the event of a breach.