dailynewsnblog
A vulnerability in a critical piece of the internet’s infrastructure was exposed this week, sending website operators worldwide scrambling to implement a fix.
The problem resided in part of the PHP coding language — a commonly used software that’s “the backbone of the internet,” according to Isaac Privett, a senior penetration tester at Toronto-based cybersecurity firm Packetlabs.
And the vulnerability had been there for years, potentially allowing bad actors to access sites, make changes to them and harvest data.
The issue prompted many to take their websites offline while they implemented a fix, causing some websites — including government ones in Canada — to go dark.
Here’s what you need to know about the PHP language, how it came to light and how serious the vulnerability is.
What is PHP?
PHP is an open-source computer language — meaning anyone can download and use it for free — that’s widely used across the internet. The tech is managed by the non-profit PHP Foundation, with a team of volunteer board members and a handful of developers.
When you visit a website, a lot of pieces of information, such as images, links and what colour a site should appear in, all need to be assembled and displayed correctly to end users, explains technology analyst Carmi Levy. That’s the job PHP does, Levy says, pulling those elements together and bringing websites to life.
“PHP is silently working in the background to make sure that websites make it from disjointed data sitting on a server somewhere to a live website that you can interact with on the browser, on the device that is sitting in front of you,” said Levy, who’s based in London, Ont.
Wiz, one of the cybersecurity firms that helped identify the issue, estimates that about 70 per cent of websites are powered by PHP, while web technology tracker W3Techs puts the figure at 75 per cent.
A programmer works with PHP code at RK Solutions software development company in Guernica, Spain, on Thursday. (Vincent West/Reuters)
That widespread use makes the tech a “foundational” piece of technology for the internet to function, Levy said, and that’s why a vulnerability with it can have potentially wide-reaching consequences.
What’s the problem, and how was it discovered?
A group of researchers from two cybersecurity companies — Calif and Wiz — released blog posts Wednesday, saying they had found two vulnerabilities in PHP. The researchers had been working as part of an OpenAI program to detect potential vulnerabilities across the internet, including within PHP.
Ryan Austin, a cybersecurity researcher at Calif.io who helped identify the problems, says he was aware of a 2004 security issue with PHP and sent OpenAI’s GPT‑5.6 Sol to look in the same part of PHP’s code for other potential bugs.
“And then a few days later, we managed to find something pretty serious,” Austin said.
The PHP Foundation explained in a Wednesday release that both issues sit in “parts of PHP that nearly every request touches: memory management and error handling.”
Austin explains that when PHP encounters an error, it leaves behind memory details that can be corrupted and potentially give hackers a way into sites.
Tech analyst Carmi Levy says the fact that PHP is used so widely across the internet is part of what makes a vulnerability with it so concerning. (Submitted by Carmi Levy)
Once inside, hackers would be able to make changes to the websites — potentially installing malware or removing content from the sites — or to read sensitive data such as passwords, according to Levy.
Wiz said the vulnerabilities had existed for more than a decade. PHP Foundation acknowledged that a researcher had theorized this possible exploit in 2024, but no concrete way to enact it was found at the time.
PHP Foundation said the delay in implementing a solution was a “structural failure” caused by a lack of resources and the security team’s decision process.
How serious is it?
Levy likens it to if one of the most popular makers of locks for doors discovered a master key was widely available to use.
“So someone could literally walk up to your front door, put that master key in, and they could gain access to your home,” Levy said.
He explains security incidents are scored on a scale from zero to 10 using something called the Common Vulnerability Scoring System. These ones ranked as a 9.2, which Levy says means they’re quite serious.
Government and corporate websites around the world were taken down after developers found flaws in the popular PHP code that could open the door to armies of hackers.
“One vulnerability in a technology that almost everybody uses means there’s a potential global impact here,” Levy said.
From Austin’s perspective, it’s “probably one of the worst vulnerabilities that I’ve ever seen.”
How is it being fixed?
Cybersecurity experts say the good news is that a solution exists.
PHP Foundation released patches for the vulnerability on Wednesday and urged those who use it in their websites to implement the fix as soon as possible.
Government cybersecurity agencies and government leaders around the world, including in Canada, echoed that call.
Many websites, including government ones from Canada, France and Japan, went dark while the potential security issue was remedied. Provincial sites for Newfoundland and Labrador and Prince Edward Island were down for the day, for example, but both appeared to be running again on Thursday.
The U.S. National Security Agency’s cyber unit called for any organizations that couldn’t patch the issue immediately to take their websites offline until the fix could be put in place.
While websites going down caused some panic, Levy says the story has a silver lining. Those sites were taken down temporarily out of an abundance of caution after researchers identified a vulnerability before hackers did, and Levy says that shows the system for flagging these kinds of things is working.
The Newfoundland and Labrador government site was offline on Wednesday after the PHP vulnerabilities were disclosed. (CBC)
Some sites experienced hack attempts after the vulnerability was made public, but those didn’t appear to work. Cloudflare’s CEO, for example, said on social media that the Cloudflare network experienced tens of thousands of attempts to exploit the flaw within 45 minutes of the announcement being made and “hundreds of thousands” within two hours.
On Wednesday, PHP Foundation told CBC News in an email they hadn’t seen any evidence of hackers being able to successfully exploit the vulnerability.
Do I need to take action?
Cybersecurity experts say because the issue affects the back end of websites, the onus is mostly on those who run them — like businesses or other organizations — to make sure they’re implementing the fix.
That’s fairly straightforward for website operators to do in most cases — somewhat like updating a personal computer, according to Privett from Packetlabs.
“You just have to upgrade to the newest version of PHP, and that seems to handle 99 per cent of your problems,” Privett said.
A new EY report suggests AI will become a major force behind cybercrime in 2026 as programs help attackers hone their scamming skills.
But because the vulnerability and the fix have been made public for quite some time now, Privett says website owners will need to be on watch for indicators of possible breaches that could have happened before they were able to put the patches in place.
“It’s always a good idea that after you patch, just to look for indicators of compromise in case that someone got in your system using that bug,” Privett said.
Privett also encourages consumers who have their own websites or apps to double check whether they use PHP to make sure that they’re protected.
And for all consumers, Levy says they can protect themselves from any potential kind of data breach by maximizing their own personal digital safety protocols. Practicing good password hygiene — by changing passwords often and not reusing them — and activating two-factor authentication, for example, help ensure that even if hackers were to access your data on a breached website, they wouldn’t be as effective at using that information against you.
