European Governments Went Dark Over a PHP Flaw Whose Fix Stalled

On 21 October, Finnish government services and the websites of the Dutch parliament, the Dutch cybersecurity authorities and the Dutch data protection regulator went offline as a precaution. The cause was a PHP flaw in the language that runs roughly 70 percent of websites. CERT-EU, the cybersecurity service of the EU institutions, told operators to patch at once or isolate internet-facing applications.

PHP’s maintainers had seen the first signs of the problem in 2024. The public heard about it on 20 October.

A public audit saw the first sign of the PHP flaw in 2024

In 2024 PHP went through its first external security audit in years. The PHP Foundation secured funding for it from Germany’s Sovereign Tech Agency, the audit was organised through OSTIF, and the firm Quarkslab carried it out. While fixing one of Quarkslab’s findings, a developer contracted by the Foundation saw the first signs of the problem behind one of the two new flaws.

A way to exploit it was theorised that year, the Foundation says, but no concrete route was found and other flaws with clearer impact took priority. Then the fix stalled. Each approach the security team drafted broke compatibility, opened new ways to crash servers or needed changes to many third-party extensions.

The team works by consensus, and work on a fix stopped and restarted repeatedly over months. The Foundation calls the delay a structural failure, caused by its decision process and a lack of resources. It says decisions can now be made by majority.

Researchers using AI turned a stalled fix into a ten-week sprint

The picture changed this summer. The security firm Calif began auditing PHP on 30 July under OpenAI’s Patch the Planet programme. On 11 August Calif reported a remote code execution with the same root cause as the 2024 problem, and OpenAI reported the same root cause the same day. Wiz followed on 24 August with further attack routes, OpenAI on 18 September.

From 11 August the fix became the Foundation’s top priority, with several people working on it full time, through weekends. It shipped on 21 October, just over ten weeks later.

OpenAI says Calif found one of the flaws with its model GPT-5.6 Sol and that Wiz found both independently. Chainguard chief executive Dan Lorenc says a researcher tipped him off on Friday 16 October that something was coming in PHP. That night he found the same memory bugs with an AI tool and a basic prompt.

Read also: Europe Writes AI Rules for Systems It Rents

Security researcher Nicholas Weaver explains why that matters: AI is good at turning a patch into an exploit, because a patch shows what changed. His conclusion is that updates now have to be applied almost instantly.

The warning reached Washington before it reached the public

The White House says the US government learned of the flaws on 16 October, and that it coordinated with federal agencies and leading AI labs to speed up the fix. OpenAI says it worked with US and foreign agencies, naming the cyber agency CISA and the White House’s cyber director’s office. Its account also refers to international partners without naming them.

Linux distributors and long-term-support vendors received the patch before release, and a few critical infrastructure providers got mitigation advice from about 23:00 UTC on 20 October, the PHP Foundation says. Cloudflare says its firewall was blocking exploit attempts from 03:02 UTC on 21 October, more than ten hours before the fix came out.

For everyone else it began with a rumour. Around 15:00 UTC on 20 October two vulnerability IDs circulated online with a wrong release time and a severity score of 10.0 (the real one is 9.2). PHP pre-announced the release at 19:30 UTC and moved it forward a day. The fix came out at 13:30 UTC on 21 October, 18 hours later.

Calif, one of the firms that reported the flaws, then published a video of its exploit working, which the Foundation says was a mistake. At 07:41 UTC on 21 October Chainguard published built images with the fix, more than six hours before the agreed release. The Foundation says that let any attacker study the fix while everyone else waited.

Lorenc says Chainguard did not leak anything. He says people were already being hit, that coordinated disclosure holds only until there is evidence of active exploitation, and that he would do nothing differently. Chainguard’s honeypots caught IP addresses from China and Russia targeting the flaws that day.

Jake Knott, head of threat intelligence at the security firm watchTowr, said attempts to exploit the flaws were already visible, including crude exploit code written quickly with AI help. None had succeeded, he said, and he did not expect that to last. Huntress had seen no exploitation among its customers by Wednesday afternoon.

OpenAI wants a say in who is told first

OpenAI published its own account on 21 October with a five-stage proposal for handling AI-found flaws in widely used software. It says it led a coalition of maintainers, researchers and security providers for two months, and that AI found the flaws before attackers did.

Under the proposal, maintainers decide whom to involve in advance, judged by an organisation’s protective role, the time it needs to act and its ability to handle sensitive information. OpenAI offers help with outreach, information-sharing agreements and coordination.

The party drafting the agreements and making the introductions holds real influence over who ends up on the list, and here it was also the company whose model was credited with a discovery. OpenAI sells the models and security product it describes, and its account mentions neither the leak nor the attack traffic Cloudflare reported the same day.

Read also: Europe’s Digital ID Will Outlive Its Promises

OpenAI also asks whether governments or others should be able to use a vulnerability to patch systems they own or manage after losing access. It says it can imagine constant scanning of the whole internet for known flaws, with owners either notified or patched, and puts this to the industry as a question.

Governments rely on a security team the Foundation calls small

The PHP Foundation says PHP runs government services, online stores, banks and media sites, yet security work on the language rests on a small group of Foundation-funded developers and a little volunteer help. It asks companies, hosting providers and governments to pay for more.

The only public funding the Foundation names is the German Sovereign Tech Agency’s support for the 2024 audit. It says that audit shows what public investment can achieve, and that it needs more of it on a sustained basis.

There are reasons for optimism, and the Foundation gives them. It set up an Ecosystem Security Team in May, uses AI tools to validate reports and expects serious flaws with hard fixes to reach its leadership sooner. watchTowr and Huntress had reported no successful attack when the patches landed.

The tail is long. PHP 8.1 and older get no official fixes, and Cisco estimates that roughly half of internet-facing installations are too old for the patches. Estimates of exposed sites and installations range from more than 1.3 million to more than 22.6 million.

CERT-EU warns that many commercial and open-source products embed PHP, so a site can be affected without anyone having chosen PHP. John Hammond, senior principal security researcher at Huntress, says the number of places to look grows very big, very fast.

OpenAI expects similar findings to rise sharply in the coming months. The Foundation says tools now find bugs faster for defenders and attackers alike, and the engineers who can decide the fixes are still few.