PHP vulnerabilities trigger website shutdowns amid AI-assisted exploitation

OpenSSL Foundation received more than €400,000 while PHP Foundation hired staff

Government websites in the Netherlands, including the country’s digital ID login service, have become unavailable. Finland has taken public services offline, and Wikimedia, the organization behind Wikipedia, switched off some systems. In his commentary in The Guardian, Chris Stokel-Walker wrote that, in most instances, the people running the sites deliberately switched them off rather than the outages resulting from cyberattacks. He said two serious PHP vulnerabilities made continued operation too risky and called the sequence a sign of fragile digital infrastructure.

Stokel-Walker attributed the shutdowns to two serious security vulnerabilities in PHP, a programming language used by about 70% of websites that can be tracked. He said the flaws gave hackers an open window into systems: an attacker might get into an online shop, steal customer addresses and passwords, or change a checkout page to harvest card details. The UK’s National Cyber Security Centre advised organizations unable to update immediately to consider taking their systems offline.

Stokel-Walker described PHP as the back-of-house team in a restaurant: a browser places an order, PHP handles the cooking and delivers the meal. He also noted that PHP stands for “PHP: Hypertext Preprocessor” and described the expansion as a recursive abbreviation. He said readers had almost certainly used a PHP-powered website that week.

Stokel-Walker said AI entered the episode in August, when researchers working with Calif, OpenAI and Wiz identified how easily the PHP issue could be exploited by using AI tools. He wrote that hackers quickly did too. Matthew Prince, Cloudflare’s chief executive, said his company had seen millions of attempts to exploit the issue already.

Researchers cited by Stokel-Walker documented about 48,000 vulnerabilities across the internet in 2025. The 2026 total had already passed 84,000, with more than two months of the year still to go, a pace he described as one every five minutes. Stokel-Walker cautioned that not every vulnerability would be as serious as the PHP issue, which scored 9.2 on a 10-point scale used to measure such flaws.

Stokel-Walker said he had been reporting on security scares in digital architecture for more than a decade and that the underlying problem barely changes. In 2014, he reported on Heartbleed, a vulnerability in OpenSSL, software that helps keep communications across the internet secure. He described the response as resting on up to two men named Steve working for OpenSSL on a shoestring budget and carrying a large share of the responsibility. Twelve years later, he wrote that the same conversation was continuing.

He said Heartbleed was not the end of the sequence. In 2021, Stokel-Walker reported on a dangerous flaw in Log4j, a seemingly mundane tool that records what happens inside computer systems. Three years later came XZ Utils, a tool for shrinking file sizes used on Linux computers into which someone had deliberately planted a backdoor. Stokel-Walker said small teams working for the public good recognized the problems, acted and averted disaster, underscoring how much vital web infrastructure depended on a handful of under-resourced people.

The PHP Foundation made that point itself this week: its developers first identified the issue that could bring the internet to a halt in 2024, but a fix was seen as too expensive and too tricky. The foundation admitted this week that the delay was a “structural failure” because of poor resource levels. Stokel-Walker used the admission to connect the shutdowns with shortages of support for the people maintaining vital software.

Stokel-Walker placed the PHP episode within a broader maintenance problem. A 2025 review by the UK government found that about 28% of central government technology was classed as “legacy,” meaning out of date, while some organizations could not even estimate how much old software they had. In April, ministers said they could not give a comprehensive account of what had since been fixed or retired.

His proposed response began with documentation: companies need to know what software they use, including obscure elements, and who is responsible for fixing it. Stokel-Walker called that documentation boring and probably overlooked, while noting that AI can help with the task. He also said the organizations protecting digital systems need adequate funding.

Stokel-Walker pointed to signs that the support problem was being addressed. The OpenSSL Foundation, the not-for-profit company affected by the Heartbleed vulnerability in 2014, received more than €400,000 from Germany’s sovereign tech fund last year to bolster its resources. The PHP Foundation hired more staff and is using AI to help triage what was important and what was not, while a number of organizations deployed fixes before the current issue went public.

Stokel-Walker nevertheless expected more days like the current one, including shutdowns when organizations judge that operating online is too risky. He said AI makes it inordinately cheaper to find weaknesses across vast volumes of old code, while repairs remain difficult. He also said automated systems powered by AI can hammer weaknesses in an instant and bombard human defenders with reports they must sift through.

Stokel-Walker argued that big technology companies, which he said make billions from software they receive for nothing because of its open-source nature, should contribute properly to maintaining it. He said governments should do the same rather than hope that a handful of exhausted developers will keep vital systems running indefinitely. Stokel-Walker said he has covered Heartbleed, Log4Shell and XZ Utils and is now documenting the fallout from PHP. He said he did not particularly want to keep reporting on the pattern, but feared he would have to keep explaining why the internet repeatedly breaks unless maintainers were properly valued.