A critical security vulnerability affecting nearly 70 percent of all websites worldwide demands immediate action from businesses and organizations. The flaw, hidden in PHP programming code for over two years, could allow hackers to seize control of internet servers without authentication.
Two-Year Delay Puts Millions at Risk
The PHP development team released emergency updates Wednesday to fix two vulnerabilities rated 9.2 out of 10 in danger level. PHP powers an estimated 70 percent of the internet, including WordPress which runs more than 40 percent of all websites. The vulnerabilities allow unauthenticated remote code execution, meaning attackers could take over servers without needing passwords or credentials. Federal agencies issued stark warnings about the severity of the threat.
The FBI Cyber Division urged affected organizations to update immediately or take systems offline until fully protected. The U.S. Cybersecurity and Infrastructure Security Agency strongly encouraged immediate patching, warning the vulnerabilities pose serious risks if left unaddressed. Britain’s National Cyber Security Centre echoed these urgent recommendations, advising organizations to prepare for immediate system updates.
Structural Failure Allowed Problem to Fester
The PHP Foundation acknowledged a potential exploit was identified as early as 2024, but fixes stalled repeatedly over months. Relevant security experts were occupied with competing responsibilities, causing work to restart multiple times. The foundation admitted the two-year delay represented a structural failure in their security processes. Only after OpenAI’s artificial intelligence models identified concrete exploitation methods in September did fixing the problem become top priority on August 11.
Amazon Threat Intelligence detected a hacking attempt on October 17 targeting one of their decoy systems, suggesting attackers may have discovered the vulnerabilities four days before the public announcement. This raises concerns that malicious actors could already be exploiting the security holes. Once discussion of the vulnerabilities began circulating on online forums and social media, the PHP team accelerated their planned announcement and fix release.
What This Means for American Businesses
Any organization running websites or web applications using PHP faces immediate risk. With PHP powering such a massive portion of the internet, the vulnerability affects countless American businesses, from small family operations to major corporations. The federal government’s urgent warnings underscore the serious national security and economic implications. Organizations must verify their systems are updated or take them offline to protect customer data, business operations, and national infrastructure from potential foreign or criminal exploitation.
