PHP Has Critical Flaw That Grants Remote Control Without a Password, FBI and PHP Foundation Warn

The alert that caught the internet by surprise

On Wednesday (21st), the PHP Foundation, the organization responsible for the PHP language, and the FBI's cyber division issued joint alerts about two critical vulnerabilities in the language. The Associated Press report, republished by ET Tech, describes the episode as one of the most notable vulnerabilities in recent times for the language considered the backbone of the web.

According to the foundation, the flaws allow unauthenticated access to sites running PHP. In practice, an attacker can take remote control of a server without needing a password, according to James Sullivan, director of cyber and technology at the Royal United Services Institute in London, interviewed by the Associated Press. With this access, it's possible to steal data, alter information, or use the compromised machine as a platform for other attacks.

The warning asked administrators to apply the patch immediately or, if that wasn't immediately possible, to take the site offline until the fix was ready and tested.

Why the damage could be massive

The severity lies in the reach: PHP is the language behind around 70% of the world's websites, according to the report. It's the foundation of WordPress and Drupal, two content management systems used by governments around the world, as well as MediaWiki, the software that runs Wikipedia.

After the alerts, several sites went offline as a precaution while awaiting or applying the fix. There were disruptions to government services and websites in the United Kingdom, Finland, and Japan. Some remain offline because there are multiple patches, each specific to a type of software, and not every organization has received or tested theirs yet.

Charl van der Walt, head of security research at Orange Cyberdefense, says this week's reaction is just the beginning. In his view, these are the first signs of instability that should spread over the coming weeks and months, as malicious actors scan the internet for systems that remain vulnerable.

AI played on both sides

The episode is also a case study in how artificial intelligence is changing web security. Humans discovered the vulnerabilities first, but AI agents helped identify how they could be exploited and supported the process of testing and validating the fixes. In a company blog post, OpenAI said it had led a coalition of researchers and security providers over the past two months to address the PHP flaws. Researchers at Wiz, a cloud security platform, say they independently used AI to arrive at the same vulnerabilities.

It's not quite as easy for defenders as it is for attackers. You find the vulnerability in something. You replace it. But with what? Is there an alternative that is patched and robust and tested and approved?

Charl van der Walt, head of security research at Orange Cyberdefense

Sullivan sees the positive side of the same phenomenon:

We've actually seen quite a decent use case here where AI can discover some critical vulnerabilities and then the community can come together to remediate them.

James Sullivan, director of cyber and technology at the Royal United Services Institute

A flaw that lay dormant since 2024

According to the PHP Foundation, the vulnerabilities had been known since at least 2024. A security team even developed several competing approaches to solve the problem, but each had drawbacks. Since there didn't seem to be a practical way for an attacker to exploit the flaw at the time, work on a definitive fix stalled. Some experts say the original discovery may date back even earlier than 2024.

The foundation took responsibility for the delay:

We won't pretend otherwise: the delay was a structural failure, caused by both the security team's decision process and its lack of resources.

PHP Foundation, in a statement

What changes for those running PHP in Brazil

The Associated Press report doesn't name Brazil among the countries with disrupted services, but exposure here tends to track the size of the national PHP footprint. WordPress dominates much of the corporate website, blog, and news portal market in the country; Drupal appears frequently on city government and public agency portals; and frameworks like Laravel and Symfony, which run on top of the PHP interpreter, underpin a significant share of Brazilian e-commerce and SaaS back ends.

In practice, this means that any Brazilian stack with PHP at its base, whether a ready-made CMS or a custom application, is potentially on the same risk list as the sites mentioned in the report. Those who outsource hosting to local providers also depend on those providers having already applied the patch at the server level, not just in the application code.

A practical checklist for those managing PHP in production

Given what has been disclosed so far, a few steps are urgent for anyone maintaining PHP-based sites or applications:

• Check the PHP version in production and confirm, directly on the project's official website, whether a security patch is already available for it.
• If using WordPress, Drupal, or MediaWiki, check those platforms' official channels for the specific patch, since fixing PHP's core doesn't eliminate the need to update the CMS.
• When the fix is not yet available or tested, follow the PHP Foundation's recommendation and take the service offline temporarily, rather than keeping a system with exposed unauthenticated access running.
• Review access logs for signs of exploitation attempts, since, according to van der Walt, malicious actors are actively scanning the internet for instances that remain vulnerable.
• Test the patch in a staging environment before applying it to production, to avoid breaking functionality, one of the reasons cited in the report for the delay some organizations are having in completing the update.

What remains unclear

The Associated Press report doesn't detail the technical identifiers of the two vulnerabilities nor specify exactly which PHP versions are affected, so administrators should follow the project's official channels for that level of detail. There's also no public confirmation, as of this publication, of mass exploitation in Brazil, which doesn't mean there's no risk. As van der Walt notes, the trend points to more disruptions in the coming weeks, as the real scope of the problem becomes clearer.