Two critical vulnerabilities in the PHP programming language were discovered late last night, affecting approximately 70% of websites globally. The vulnerabilities were identified by the security firm Wiz, utilizing several artificial intelligence (AI) models: Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol.
The first vulnerability allows for unauthenticated Remote Code Execution (RCE). The second is a bug that causes memory corruption, enabling attackers to leak passwords, tokens, API keys, and security certificates.
These vulnerabilities are considered serious because PHP is used by major platforms, including WordPress, Drupal, Joomla, and Wikipedia. They affect sites running PHP version 5.4 and above. PHP released two security patches yesterday and has urged website operators to perform updates immediately.
Following the announcement, government websites in the Netherlands, Denmark, Finland, and France were taken offline temporarily to carry out these critical updates.
