PHP vulnerability: millions of sites at risk, US recommends immediate updating
On October 21, numerous French websites, including those of ministries, prefectures, and major media outlets, were taken offline to address critical security vulnerabilities in the PHP programming protocol. The Ministry of Interior confirmed that all prefecture sites, including the Paris Police Prefecture, were placed under maintenance at the request of ANSSI, France’s cybersecurity agency, while updates were being applied. The alert was triggered by CERT-FR after discovering two critical flaws in PHP, which powers over 600,000 servers in France and allows for dynamic web page generation. These vulnerabilities could enable denial-of-service attacks, prompting CERT-FR to recommend taking affected servers offline until patches released on October 21 were installed. The issue has international implications, with government portals in Finland, Denmark, the Netherlands, and Belgium also experiencing outages, while the US National Security Agency recommended immediate software updates for all sites using this protocol.
On Wednesday, October 21, thousands of websites across the globe were temporarily taken offline following the discovery of two critical vulnerabilities in the PHP programming language. The flaws, which had existed within the software for years, were identified using artificial intelligence tools. This revelation forced government agencies, major corporations, and web operators to disable their digital services as a precautionary measure while urgent security patches were distributed. The disruption affected a significant portion of the internet, with estimates suggesting that up to 70 percent of the world’s web relies on PHP. In France, the impact was immediate and widespread. At the request of the French Agency for Cybersecurity (ANSSI), the Ministry of the Interior placed its entire suite of internet sites into preventive maintenance mode. This included the websites of the tax authority, the Prefecture of Police, Météo-France, the National Commission for Computing and Freedom (CNIL), the Agency for Ecological Transition (ADEME), and the cybermalveillance.gouv portal. Nearly all prefectural websites in France were also inaccessible later in the day. The ministry stated that its teams were mobilized to perform update operations as soon as the security patch became available from the publisher. Until then, official communications from the prefectures would be conducted via social media channels and physical signage. Other French entities, including the Ministry of Culture, the Ministry of Ecology, and major media outlets such as Les Echos and Challenges, along with the automotive manufacturer Renault, also displayed maintenance pages during the afternoon. The alert was triggered by the Computer Emergency Response Team France (CERT-FR) after identifying the critical vulnerabilities. ANSSI noted that more than 600,000 servers in France utilize the PHP protocol, which serves as an engine allowing websites to generate dynamic pages based on user interaction or server data. On October 20, the software editor published a communication regarding the two critical flaws, noting that their exploitation could enable denial-of-service attacks. Security patches were subsequently released on October 21. CERT-FR recommended that affected servers remain offline until the updates integrating these security corrections were fully applied. Similar disruptions occurred across Europe and beyond. In Finland, the government’s internet portal indicated that state websites were totally or partially unavailable. Public service platforms in Denmark, the Netherlands, and Belgium were also taken offline. The Dutch cybersecurity agency itself went offline, citing the vulnerabilities as the reason for the precautionary shutdown. The operator of the online encyclopedia Wikipedia stated that it had taken down an unspecified number of systems until they could be safely patched. Similarly, the Internet Archive, a large-scale online library, briefly interrupted its service to address the issue. Global cybersecurity agencies issued urgent directives. The United States National Security Agency recommended that all sites using the PHP protocol perform immediate software updates to close the critical gaps. Palo Alto Networks, a cybersecurity specialist, identified 22 million platforms exposed to these vulnerabilities worldwide. Data from Censys, an internet intelligence firm, indicated that approximately 1.5 million out of 2.6 million hosts reported running a version of PHP for which no fix was yet available at the time of analysis. World leaders also commented on the situation. Japanese Prime Minister Sanae Takaichi posted on the platform X that website owners should check if their live sites use PHP and prepare to apply the new fix. The Dutch Prime Minister stated that he was closely monitoring the developments. The vulnerabilities were discovered through the use of artificial intelligence. Two cybersecurity companies, Calif and Wiz, independently reported finding the flaws. Calif stated in a blog post that it identified the issues on August 1 using a large language model and had been working since then to develop a fix. Wiz, a cybersecurity firm owned by Alphabet, announced that it had discovered the flaws using its autonomous search tool, Wiz Atlas. The bugs had remained hidden in the codebase for over a decade. Experts warned that the combination of public fixes and advanced AI tools created a dangerous environment. Costin Raiu, co-founder of the cybersecurity research firm TLP:Black, described the current situation as an AI-powered "race to exploit." He predicted that the next step would be the mass compromise of every vulnerable web server on the internet. Wiz noted that prior to the advent of AI, manually implementing and scaling such exploits would have been difficult, but AI removes that barrier. Because AI tools can reverse-engineer the bug with little effort, hackers are rushing to exploit unpatched systems before organizations can deploy updates. PHP, which originally stood for "Personal Home Page" and dates back to the early 1990s, underpins a vast section of the public-facing web. It is integrated into popular content management systems and e-commerce platforms, including WordPress, Drupal, Joomla, and Magento. Tiffany Farriss, interim chief executive of the Drupal Association, stated that all servers using any version of PHP released in the last 20 years are vulnerable. She emphasized that the issue impacts the majority of the internet. According to web analytics tracker W3Techs, PHP supports roughly 75 percent of all websites where the server-side language can be identified. Wiz estimated that PHP runs about 70 percent of the world’s web. The developers of the language published urgent fixes on Wednesday, urging all users to update immediately.
4 reports
L'ExpressIndependent🔒CenterFactual 90Objective 8512 hr. ago
European governments and other organizations took their websites offline on Wednesday after critical security vulnerabilities were discovered in the widely used PHP programming language. The flaws, which had existed undetected for years, were identified using artificial intelligence, prompting developers to release urgent patches and urging users to update immediately. Tech companies warned that hackers were already exploiting these weaknesses, leading cybersecurity agencies worldwide to advise immediate updates or temporary shutdowns of affected systems. Experts noted that AI tools could easily reverse-engineer the bugs, creating a race condition where attackers might compromise vulnerable servers before patches are applied. Data indicates that approximately 1.5 million hosts out of 2.6 million still use unpatched versions of PHP, highlighting the scale of potential exposure across the internet.
Bias read (Center): The article reports on a technical cybersecurity incident involving software vulnerabilities and the subsequent defensive actions by various entities. While government websites are mentioned as being taken offline, the core subject is IT infrastructure and software security rather than political ide
Why factuality (90): Accurate representation of the event. Correctly identifies the discovery via AI, the nature of the PHP vulnerabilities, and the global response including government sites going offline. Cites specific experts (Costin Raiu) and provides context on the timeline and the role of AI in both discovery and
Why objectivity (85): Neutral and informative tone. Presents facts clearly without excessive adjectives. Includes expert quotes to support claims about future risks ('race to exploitation'). Balanced perspective that acknowledges the severity without resorting to panic-inducing language.
La CroixParty-alignedCenterFactual 85Objective 9014 hr. ago
On October 21, numerous French websites, including those of ministries, prefectures, and major media outlets, were taken offline to address critical security vulnerabilities in the PHP programming protocol. The Ministry of Interior confirmed that all prefecture sites, including the Paris Police Prefecture, were placed under maintenance at the request of ANSSI, France’s cybersecurity agency, while updates were being applied. The alert was triggered by CERT-FR after discovering two critical flaws in PHP, which powers over 600,000 servers in France and allows for dynamic web page generation. These vulnerabilities could enable denial-of-service attacks, prompting CERT-FR to recommend taking affected servers offline until patches released on October 21 were installed. The issue has international implications, with government portals in Finland, Denmark, the Netherlands, and Belgium also experiencing outages, while the US National Security Agency recommended immediate software updates for all sites using this protocol.
Bias read (Center): The article reports on a technical cybersecurity incident affecting both private and public entities. While government agencies are involved, the focus remains on the technical vulnerability, the remediation process, and the global scale of the threat rather than political debate or partisan framing
Why factuality (85): Factually sound regarding the French context. Correctly cites Anssi, CERT-FR, and the Ministry of Interior. Accurately describes the types of sites affected (prefectures, ministries). Minor potential confusion in terminology ('protocol' vs 'language'), but otherwise precise. The date mentioned (Oct
Why objectivity (90): Very objective and dry journalistic style. Focuses on official statements and procedural responses. No emotional language or speculation beyond what is attributed to officials. Straightforward reporting of the situation and the official reaction.
Le FigaroIndependent🔒CenterFactual 45Objective 3011 hr. ago
Two critical vulnerabilities discovered in the PHP programming language have forced thousands of websites worldwide to go offline temporarily while patches are developed. The security flaw affects approximately 70 percent of the global web, exposing millions of personal data records to potential compromise. In France, the National Cybersecurity Agency (ANSSI) ordered the Ministry of Interior to take down all exposed government websites, including those of tax authorities, police prefectures, and meteorological services, placing them into preventive maintenance mode. International reactions included panic among Japanese leadership and the US National Security Agency due to the scale of the threat. As of Wednesday evening, many affected sites remained inaccessible, highlighting the urgent need for software updates across the digital infrastructure.
Bias read (Center): The article reports on a technical cybersecurity incident affecting government and private entities globally. While it mentions government responses and international agencies like the NSA, the core subject is a software vulnerability and its immediate operational impact rather than a political or政策
Why factuality (45): The article contains significant hyperbole and potentially inaccurate details. It claims 'governments panicked' and mentions the Japanese Prime Minister and NSA being in 'full panic,' which is likely an exaggeration not supported by standard reporting on this specific technical incident. While the c
Why objectivity (30): Highly sensationalist tone. Uses words like 'panicked,' 'urgently unplugged,' and 'secrets.' The headline is clickbait-heavy. The writing style prioritizes drama over neutral reporting, injecting fear and urgency into what was primarily a routine (though critical) security patching event.
BFM TVIndependentCenterFactual: no official source document/info detectedObjective 7016 hr. ago
The provided text consists solely of a headline indicating that websites belonging to numerous French government agencies, including Météo-France, prefectures, and ministries, have been placed under maintenance. This action was taken in response to a critical security vulnerability identified in the PHP software used by these platforms. The report highlights the widespread impact of this technical flaw on public digital services but does not provide further details on the specific nature of the bug or the timeline for restoration.
Bias read (Center): The subject matter concerns a cybersecurity incident affecting government infrastructure, which is primarily a technical and administrative issue rather than a politically contested debate. While government operations are involved, the focus is on the technical failure and its immediate operational,
Why factuality: no official source document/info detected
Why objectivity (70): Neutral based on the available text. The headline is descriptive rather than sensational. However, the brevity makes it difficult to assess full balance, though no bias is evident in the visible portion.
How each side covered it
The same event, grouped by the political lean of the outlets covering it.
progressive
center
conservative
★
How each side covered it
Support independent, bias-aware news and unlock the social pulse, community voting, and every other Supporter feature.
France
