Critical PHP Flaws Drive Widespread Website Outages as Patching Lags
A combination of two critical vulnerabilities in PHP, the scripting language powering approximately 70% of websites, has triggered a wave of deliberate site outages. Discovered in mid-August by AI models and researchers, the flaws allow attackers direct access to underlying file systems and databases. As Amazon Web Services reports broad exploitation, the NSA advises unpatched sites to go offline, causing significant global web instability.
Key points
- PHP, an open-source scripting language used by roughly 70% of all websites, suffered a critical security breach involving a combination of two distinct vulnerabilities.
- The flaws, discovered in mid-August by AI models and a cybersecurity researcher, allow attackers to access the underlying file system or database, exposing vast amounts of personal data.
- Amazon Web Services stated the vulnerabilities are being broadly exploited across the internet, prompting the National Security Agency to advise unpatched sites to go offline temporarily.
- Disclosure was embargoed to allow the PHP Foundation time to develop patches, though the news leaked two days before the scheduled release, catching many site owners off guard.
- Many website owners have proactively taken their sites offline to prevent data exposure, creating a noticeable dip in global web availability unrelated to standard service outages.
A significant portion of the global web is experiencing deliberate outages as site owners grapple with critical security vulnerabilities in PHP. The scripting language, which underpins approximately 70% of all websites, was found to contain a combination of two flaws that expose underlying file systems and databases to attackers. This discovery, made in mid-August by both AI models and a cybersecurity researcher, has led to a rush of defensive measures across the internet.
The PHP Foundation initially embargoed the disclosure to allow developers time to implement patches, but the news leaked two days early. Consequently, many sites have not yet been updated. Amazon Web Services reports that the vulnerabilities are being broadly exploited, with attackers gaining direct access to sensitive data. In response, the National Security Agency has recommended that unpatched sites be taken offline entirely until the fix is applied.
This situation highlights the fragility of web infrastructure reliant on a single, widely adopted technology. While the patch is available, the lag in adoption has resulted in a temporary but significant reduction in web availability. For global users, this means some popular sites may remain inaccessible until their operators complete the necessary security updates.
Sources
The WireByte editorial team synthesises technology news from multiple primary sources, verifies the facts, and links every source. Articles are produced with AI assistance and reviewed under our editorial policy.
