Global websites go offline as critical PHP software vulnerabilities exposed

OPA WIRE, Oct 21 (OPA) — Operators across Europe and Japan shuttered public-facing websites as a precautionary measure against potential exploitation. The Wikimedia Foundation and various government entities, including the Port of Rotterdam and the French Interior Ministry, took systems offline to prevent unauthorized access. The flaws, which involve how PHP manages server memory, could allow attackers to steal data or weaponize trusted websites to launch secondary attacks.

Security researchers and the NSA warned that the vulnerabilities permit hackers to take control of servers without requiring credentials. Cloudflare reported early signs of active exploitation, while the cybersecurity firm Patchstack confirmed receiving reports of ongoing attacks. The PHP security team released patches at 10 a.m. ET, initiating a race between administrators and attackers to secure systems before exploits are weaponized.

PHP serves as the backbone for major content management systems including WordPress, Drupal, Joomla, and Magento. Because the language is ubiquitous across shared hosting platforms and control panels, the potential attack surface spans millions of servers. The vulnerabilities specifically involve memory handling, where the software either mishandles information during memory errors or reuses previously released memory data.

Experts warn that the integration of artificial intelligence into hacking workflows significantly elevates the risk of rapid, large-scale exploitation. Thai Duong, CEO of Calif, noted that automated tools could quickly reverse-engineer patches to develop exploit scripts. As organizations scramble to apply updates, cybersecurity agencies advise isolating internet-facing applications from public networks until patches are fully implemented.