What in the PHP is going on?

TL;DR: If “PHP” has been popping up on your feed this week, you’re not alone. It’s all anyone can talk about as websites and apps around the world (including plenty you use) race to update after cybersecurity researchers discovered two flaws in PHP, the coding language that runs most of the internet. It’s why you may have noticed some sites go dark at unexpected times in the past few days.

What happened: Your company’s CTO could probably use your thoughts and prayers right now—one said he didn’t sleep for days after the flaws leaked on Tuesday. PHP developers released an emergency fix on Wednesday for the two flaws, which could let hackers take over a website without needing a password. Amazon also found hackers trying to exploit the flaws four days before the fix was out, and urged sites to update immediately. No breaches have been confirmed so far—although attempts to exploit the bug jumped from thousands before the announcement to millions by Wednesday night, per Cloudflare’s CEO.

Though they only recently disclosed this to the public, researchers at OpenAI and two security firms found the bugs over the summer using AI. A limited version of the problem was actually flagged in 2024 but was brushed off as too hard to exploit—a moot point now given AI’s rapid progress.

What exactly is PHP?: It’s the programming language behind roughly 70% of websites, so a flaw in PHP leaves a lot of the digital world vulnerable (including sites with sensitive information, like government portals and online stores). PHP largely relies on volunteers to help maintain it (including this one man who is now being hailed as the unsung hero of the internet).

Why you should care: Attackers can exploit these vulnerabilities to get into a website’s server (where its data lives) and steal everything from passwords to personal information, or use the site to spread malware to the people who visit it. The NSA advised any organization that couldn’t install a fix right away to consider going offline until it could. Many did: Websites in the US and around the world started going dark on Wednesday.

Bottom line: If a site or app you use is down this week, this may be why. And if it tells you to update your password, take it extra seriously right now (and make sure they aren’t recycled). —LC