PHP Vulnerabilities Force Major Websites Offline Worldwide

The context

PHP is one of the most widely used technologies on the web, estimated to run roughly two-thirds of websites. That reach is what turned a pair of software bugs into a week of outages touching sites across the internet, including government sites that went dark.

The timeline worked against defenders from the start. Exploitation attempts showed up in Amazon Web Services logs four days before patches existed, per Wired, meaning attackers had a head start on a flaw with no available fix. The vulnerabilities were discovered through AI-assisted methods, a detail noted across coverage, though the material does not spell out exactly how that discovery process worked or who conducted it. Once patches shipped, the response became a race between administrators installing updates and attackers probing for systems that had not yet been secured.

Why it matters

The scale here is unusual. PHP's footprint means these flaws touch a vast swath of the internet, from small personal sites to platforms used by millions, and the involvement of the FBI and NSA signals the federal government views the threat as serious. Major sites chose to go offline rather than stay exposed, a disruption felt directly by users. For businesses and site operators, the stakes are immediate: any unpatched server is a target for attacks already underway, not a hypothetical future risk.

What’s next

The immediate priority is patching. Security teams are pressing administrators to update PHP installations now, since exploitation is ongoing and broad. Key open questions include how many servers remain vulnerable, whether attackers compromised systems during the four-day window before patches existed, and how long major sites will stay offline. Further guidance from the FBI and NSA, and any disclosures about successful breaches, are worth watching.