Critical PHP Flaws Trigger Global Website Scramble: Wikipedia, BBC, and Government Sites Affected
A wave of urgent patching swept across the internet this week after two critical vulnerabilities were disclosed in PHP, the widely-used back-end programming language that powers a vast portion of the web. International governments and agencies issued warnings urging websites to address the flaws, which carry a critical severity rating of 2 out of 10 under CVSS v4—a scale where lower numbers indicate higher risk. The vulnerabilities were serious enough to prompt the PHP maintainers to release patched versions of PHP 8 ahead of schedule, following leaks of the flaws on 20 October via Hacker News forums, a post on X by cybersecurity firm watchTowr labs, and a proof-of-concept exploit video mistakenly released by Calif. The early disclosure forced an accelerated response, with temporary mitigations published but no complete workaround offered—updating was declared the only safe choice.nnThe impact was immediate and widespread. Websites around the world were taken offline on Wednesday and Thursday, including high-profile platforms such as Wikipedia, the BBC, and various government sites. The UK government confirmed that some services were affected but stated that no large UK public-facing critical services had been impacted. Other sites, like the art platform DeviantArt, displayed messages saying they were “temporarily down for maintenance, external” without specifying the reason, hinting at the scramble behind the scenes. The outages underscored the far-reaching consequences of the PHP flaws, which affect a language that has been a cornerstone of web development for decades.nnThe response from the security community was swift but complex. Volunteer maintainer Ondřej Surý, who received advance access to the fixes, prepared installable packages for old PHP versions from the patched source code, enabling server administrators to automate deployments without compiling PHP themselves. This effort was crucial in accelerating patch adoption across diverse systems. Meanwhile, cybersecurity firm Wiz highlighted the role of advanced AI in the exploit development process: “Frontier models were critical to making this process practical, enabling us to develop and adapt working exploits across multiple applications in hours,” the company said in a blog post. This revelation points to a growing trend of AI-assisted vulnerability discovery and exploitation, raising concerns about the speed at which attacks can now be developed.nnThe incident serves as a stark reminder of
Shimanta Das 
