A major security flaw in PHP, used by around 70 per cent of websites, forced organisations worldwide to shut down sites as hackers could take control of vulnerable servers without a password.
Government agencies and companies globally took websites offline after two critical flaws were identified in PHP, a programming language used by a large share of the internet. The vulnerabilities allow attackers to take over web servers without needing a password, according to the US National Security Agency.
The PHP Foundation released a fix on Wednesday, urging users to update immediately. The flaws were discovered using AI models, with the number of vulnerabilities found in 2026 expected to roughly double last year's record total. The issues are considered among the most severe in PHP's history, comparable to the Heartbleed flaw from 2014.
Why it matters
The flaw allows hackers to take control of vulnerable servers without a password, prompting immediate site shutdowns.
This section reflects Dumpling editorial interpretation and is provided for context only.
What to watch
Watch whether PHP users deploy the critical fix before further exploitation becomes possible.
This section reflects Dumpling editorial interpretation and is provided for context only.