Explainer-What is PHP and why did it take government websites offline?
asserted
it → take → websites
Government websites across Europe went dark on Wednesday as operators raced to patch two critical vulnerabilities in PHP, one of the most widely used programming languages on the web.
asserted
operators → go → web
The developers of PHP said on Wednesday they would release patches for two critical vulnerabilities, and EU cybersecurity officials warned organisations unable to apply the fixes to take affected websites offline.
asserted
officials → say → websites
Here is what you need to know:
asserted
you → need → what
PHP is a programming language that runs websites.
asserted
that → run → websites
It works behind the scenes.
asserted
It → work → scenes
When a user loads a page, the server running PHP assembles the content and sends the finished page to the browser.
asserted
server → load → browser
It is free, open source and maintained by volunteers.
asserted
It → maintain → volunteers
Site owners rarely interact with it directly.
asserted
owners → interact → it
PHP runs nearly 70% of all websites whose programming language can be identified, according to web technology tracker W3Techs.
uncertain
language → run → W3Techs
It is the engine behind WordPress, the software that powers about 40% of all websites such as blogs, small business pages, government portals, online shops and news sites.
asserted
that → power → blogs
The two vulnerabilities are rated 9.2 out of 10 on the CVSS v4.0 severity scale, a standard industry scoring system.
asserted
vulnerabilities → rat → scale
CERT-EU, the European Union's cybersecurity response team, said that rating signals unauthenticated remote code execution, meaning an attacker can run commands on a vulnerable server, over the internet, with no password or account.
asserted
attacker → say → password
A single flaw in PHP opens the same door on millions of servers at once.
asserted
flaw → open → servers
Whoever exploits the flaw controls the website.
asserted
exploits → exploit → website
GoDaddy, a web hosting provider, said that could mean stolen data, defaced pages or full-system compromise.
uncertain
that → say → data
Cloudflare's chief technology officer said early attacks were emerging.
asserted
attacks → say → ?
Most small websites are typically run by owners with no security staff, often on shared hosting where they do not manage the server and may not know who updates PHP.
uncertain
who → run → PHP
Wordfence, a security plugin for WordPress sites, warned that the usual automatic updates will not apply this fix.
asserted
updates → warn → fix
CERT-EU's guidance is to take affected sites offline rather than leave them exposed.
asserted
guidance → take → them
HOW WAS IT FOUND?
Researchers at security firm Calif, working with OpenAI, reported the first flaw to PHP on August 11 after finding it with OpenAI's GPT-5.6 Sol model, the company said.
asserted
company → find → model
Wiz, a security firm owned by Alphabet's Google, found the flaws independently and reported a second one on August 24, also using AI models.
asserted
Wiz → own → models
Wiz said the findings "rank among the most severe vulnerabilities discovered in PHP, and arguably in software history."
asserted
findings → say → history
The underlying flaws had been present for decades, the firm said, but proving they were exploitable required a chain of steps "at the edge of what human researchers could practically achieve."
uncertain
researchers → underlie → what
US President Donald Trump's administration said it was "tracking and coordinating with federal agencies and leading SI labs to expedite the release of the fix," referring to Trump's preferred name for artificial intelligence.
asserted
it → say → intelligence
It framed the discovery as evidence that American "Super Intelligence" strengthens national security.
asserted
Intelligence → frame → security
The Aporia
