Two critical security flaws in PHP, the software that helps run much of the modern web, have prompted an urgent global response. PHP’s maintainers have released fixes, but websites remain at risk until their operators apply them: the flaws could allow an attacker to run commands on an unpatched server without a password or account.
PHP is a free, open-source programming language used to build websites and web applications. It runs on the server rather than in the visitor’s browser. When someone opens a website, PHP can process forms, manage logins, retrieve information from databases and generate the page they see. Simply put, PHP is a server-side scripting language used to develop roughly 70 per cent of the world’s websites.
The vulnerabilities were disclosed on October 20 and fixed in updates released on October 21. OpenAI said its Patch the Planet initiative, working with security firm Calif, identified one flaw using its GPT-5.6 Sol model. Cloud-security company Wiz also independently discovered and reported both.
PHP’s maintainers led the fixes, with OpenAI, Wiz, Cloudflare and others assisting with research and coordination. The stakes are high because the flaws are rated 9.2 out of 10 on the CVSS v4.0 severity scale. This meant that an attacker could potentially take control of or disrupt a vulnerable website and access sensitive information, as per CERT-EU.
Indian websites need to patch PHP-based systems
Back in India, many government portals, news sites, e-commerce platforms, educational institutions and small businesses rely on PHP-based systems. An unpatched server may expose customer records, payment-related data, internal files or the ability to redirect visitors to malicious pages.
The immediate remedy is to check your version, update PHP to a version containing the official fixes, then verify that the update is running. Operators should also check with hosting providers and software vendors, apply interim protections where necessary and review systems for signs of compromise. CISA advises organisations to prioritise remediation according to exposure, exploitation risk and potential impact.
Some government websites in Europe and elsewhere were temporarily taken offline before or while fixes were being deployed, as a containment measure during the period when the flaws were public but many servers had not yet been updated.
While AI helped patchers find and fix flaws before attackers exploited them, the same capabilities could also have been used to attack PHP servers.
