A serious security flaw in PHP, the language that runs a large share of the web, has led several governments to take websites offline for a short time while they apply fixes. The Guardian reports that the takedowns were precautionary.
PHP and what it does
PHP is a programming language built for making websites. It runs on the server, which is the computer that hosts a website. It does not run in the visitor’s browser. When someone asks for a page, the server runs PHP code that might fetch records from a database, check a login, or build the page from templates. It then sends the finished HTML to the visitor. The visitor never sees the PHP code, only what it produces.
This is why the language is so widespread and also so easy to overlook. Many popular content management systems, forums, online shops and custom-built government portals are written in PHP. People who run websites often don’t think of themselves as PHP users at all. They installed a publishing platform, and PHP came with it. According to the Guardian, almost 70% of websites use the language, so a weakness in PHP can affect a very large number of sites at once.
Strictly speaking, PHP is both a language and an interpreter. The interpreter is the program installed on a server that reads PHP code and carries it out. A flaw can sit in a website’s own code, in a framework built on PHP, or in the interpreter itself. The reports describe this flaw as being in the language, which points to the interpreter or its core components. Applications built on top of PHP are a different layer. The full technical details have not been confirmed in the material available.
Origins of the language
PHP began in the early years of the commercial web as a small set of tools for keeping simple personal web pages up to date. It grew into a full language because it solved a common problem: it let people mix program logic directly into web pages without learning a heavier system. Cheap hosting companies began offering it by default. A whole generation of web developers learned it as their first server-side language.
Over time PHP became an open-source project maintained by volunteers and contributors. New major versions brought better speed, stricter typing and many security improvements. Like most mature software, it follows a release cycle. Each version gets security fixes for a fixed period and is then retired. Many servers keep running older versions long after official support has ended. This is one reason PHP flaws are hard to clean up across the whole web.
The flaw and the response
The Guardian reports that websites in Belgium, the Netherlands, Finland, France and Germany were among those taken down temporarily by government authorities. Experts warned that malicious actors could exploit the weakness, and the authorities moved to patch it. Some important details are not known from the reporting available: the exact nature of the bug, which PHP versions are affected, and whether anyone has actually exploited it.
Taking a site offline before patching is a cautious step. While a known, serious flaw remains unpatched, every exposed server is a potential target. Once a vulnerability is made public, attackers can often study the fix to work out how to exploit the bug. For an organisation that holds sensitive data or provides public services, a few hours of downtime can be a smaller risk than being compromised.
Patching a language-level flaw usually involves several steps. The maintainers release corrected versions of the interpreter. Operating system distributors and hosting providers package those versions. Then each server administrator installs the update and restarts the affected services. Organisations that run many sites, or that depend on old PHP versions their applications cannot easily leave, may need much longer. Until then, some use temporary measures, such as web application firewalls or configuration changes that block the vulnerable feature.
Common misconceptions
One common mistake is to assume that a flaw in PHP means every PHP website is open to immediate attack. Whether a given site is exposed depends on how the flaw works. Exploitation may require a particular configuration, operating system, server setup or feature. Without confirmed technical details, it cannot be said how many sites are actually at risk.
A second misconception is that a site going offline must have been hacked. In the cases the Guardian describes, the shutdowns were precautionary. Taking a service down while it is patched is a defensive decision, not evidence of a breach.
A third is that ordinary visitors need to update something on their own devices. PHP runs on web servers, not in browsers or on phones. The responsibility for fixing a server-side flaw lies with the people who operate the websites and their hosting providers. That said, any site that has been compromised could put its users’ data at risk. This is why operators act quickly.
Finally, people sometimes conclude that PHP is uniquely unsafe. Every widely used language and runtime has had serious vulnerabilities. A flaw in PHP has wide effects because of how common the language is, not necessarily because it is less secure than the alternatives.
Where to look next
Readers who want reliable updates should start with the official PHP project. It publishes release notes and security announcements for each supported version. National cybersecurity agencies in the affected countries usually issue advisories with practical guidance for administrators. These often include the affected versions and recommended workarounds. Public vulnerability databases, which give each flaw a standard identifier, track the technical details as they are confirmed.
Anyone who runs a website should check which PHP version their server uses and whether their hosting provider has applied updates. They should also confirm that their content management system and plugins are still supported. Moving off end-of-life PHP versions remains one of the most effective ways to reduce exposure to future flaws.
Frequently asked questions
What is PHP used for?
PHP is a programming language that runs on web servers and builds the pages that visitors see. It powers many content management systems, online shops, forums and custom websites, including public-sector portals. The Guardian reports that almost 70% of websites use PHP. This means a security weakness in the language itself can affect a very large number of sites around the world at the same time.
Why did governments take websites offline because of the PHP flaw?
The Guardian reports that the shutdowns were precautionary. Authorities in several European countries took sites down temporarily while they applied patches. A known but unpatched flaw leaves servers exposed to attackers who may try to exploit it. For organisations that handle sensitive data or public services, a short planned outage can be safer than leaving a vulnerable system online.
Do I need to update anything on my computer or phone?
Usually not. PHP runs on web servers, not in browsers or on personal devices. Fixing a server-side flaw is the job of the people who run websites and the companies that host them. Visitors should still follow general good practice, such as using unique passwords, in case any service they use was compromised before it was patched.
How do I know if my website is affected?
Start by finding out which PHP version your server runs, which hosting dashboards usually show. Then compare it with the official PHP security announcements and any national cybersecurity advisory. If your site is on shared hosting, contact your provider to confirm they have applied the update. Also check that your content management system and plugins are still supported and up to date.
Which PHP versions are affected by the vulnerability?
The material available does not confirm which versions are affected or describe the technical nature of the flaw. The most reliable sources for those details are the official PHP project’s release notes and security announcements, along with advisories from national cybersecurity agencies. Administrators should rely on those sources rather than on unofficial summaries, which may be incomplete or inaccurate in the early stages.
Sources and further reading
- The Guardian: technology reporting on the PHP vulnerability and the precautionary website shutdowns in several European countries
- The PHP project: official release notes, supported-version schedules and security announcements
- National cybersecurity agencies in the affected countries: advisories and guidance for system administrators
- Public vulnerability databases: standardised records tracking the technical details of disclosed software flaws
Surfaced from the rss:guardian_tech signal “critical PHP security flaw”. AI-assisted draft, editorially reviewed.
