What Is PHP and Why Did It Take Government Websites Offline?

PHP is a programming language that helps run websites all over the world. When you load a page on your browser, PHP works in the background to gather information and send you the finished page. It is free, built and maintained by volunteers, and powers nearly 70 percent of all websites whose coding language can be identified. It is also the engine behind WordPress, which runs about 40 percent of all websites, from small blogs to government portals.

Two serious flaws were discovered in PHP in the fall of 2025. These flaws were rated 9.2 out of 10 on a standard danger scale used across the tech industry. That high score means an attacker could take control of a server from anywhere in the world without needing a password or an account. Because PHP is used on so many websites, one flaw can put millions of servers at risk at the same time.

Small websites are especially vulnerable because most do not have security experts watching over them. Many small site owners share a server with other users and may not even know what version of PHP is running their site. A security company called Wordfence warned that the normal automatic software updates will not fix this particular problem. That means website owners must take extra steps on their own to stay protected.

The first flaw was found by researchers at a security firm called Calif, working together with the AI company OpenAI. They used an AI model called GPT-5.6 Sol and reported the flaw on August 11. A separate security firm called Wiz, which is owned by Google's parent company Alphabet, found a second flaw on August 24 using its own AI tools. Both firms reported what they found to the PHP team so a fix could be created.

These flaws had actually been hiding in PHP's code for decades, but no one had proven they could be used by attackers until now. Figuring out how to exploit them required a long chain of difficult steps that human researchers alone would have struggled to complete. AI tools helped make that discovery possible. The U.S. government said it was working with federal agencies and AI labs to speed up the release of a fix, calling the discovery proof that AI can strengthen national security.