The PHP Foundation confirmed that the first signs of the flaws that resulted in the preventive suspension of several websites in various nations emerged in 2024. The process of correcting these vulnerabilities was interrupted and restarted multiple times due to resource scarcity and difficulties encountered by the security team.
These flaws have the potential to allow attackers to gain control over servers without needing login or password credentials. A security update has already been made available, and both governmental and corporate entities have implemented preventive measures to reduce the probability of attacks.
The problem was detected during an external audit conducted in 2024 by Quarkslab, a French company specializing in cybersecurity. According to the PHP Foundation, the effort to fix the vulnerabilities spanned several months and faced three significant obstacles.
The foundation also acknowledged that the language's security depends on a limited number of developers, who are supported by foundations, and volunteer contributors. Resource constraints generate great concern, given the widespread use of PHP on the internet, being employed in notable platforms such as Facebook, Wikipedia, and WordPress, in addition to Moodle, used by educational institutions, and Magento, focused on e-commerce.
The PHP Foundation uses artificial intelligence tools, such as Claude Mythos, to analyze code and evaluate flaw reports. Although these resources help identify problems more quickly, they are not capable of defining the ideal way to structure a fix.
The investigation into the flaws progressed beyond the foundation. The security company Calif and OpenAI, responsible for ChatGPT, independently identified the vulnerabilities and reported them in August of this year. Subsequently, Wiz, a cloud security specialist, discovered other ways to exploit these flaws.
On Wednesday (21), Wiz classified the incident as one of the most critical ever recorded in PHP. The company stated that such discoveries fall among the most serious vulnerabilities found in PHP and possibly in the history of the software. The company added that, for over a decade, these critical flaws remained unresolved because detecting and exploiting vulnerabilities was extremely complex without the aid of AI.
To investigate the flaws, Wiz used Google's Gemini 4 Argon models and OpenAI's GPT-5.6 Sol.
Since Wednesday (21), governments and companies in various countries have temporarily suspended access to their websites as a preventive measure against intrusions. In Brazil, the National Telecommunications Agency (Anatel) and courts suspended access to the Electronic Information System (SEI), used in administrative processes. To date, no major losses have been reported in the country.
The vast extent of the exposure helps justify the concern about the flaw. Thiago Ayub, CTO of Sage Networks and telecommunications expert, points out that public rankings indicate that PHP is the language used in approximately 70% of websites.
With the security update already available, implementing the fix in affected systems constitutes the main strategy to mitigate the risk of intrusions.
