Critical PHP flaw threatens 70% of websites, emergency patches issued

A critical vulnerability in the PHP programming language, which powers over 70% of websites, has prompted emergency patches and urgent global warnings from cybersecurity agencies. The flaw could allow hackers to take over millions of websites and their servers if left unfixed. The issue was discovered by researchers using AI tools in August, confirmed by PHP developers in late September, and publicly leaked before a patch was ready. Governments and operators, including the Port of Rotterdam, have taken websites offline, urging developers to apply updates immediately. The patch rollout is complex because PHP underpins many third-party plugins and services, requiring each supply chain layer to update. This incident highlights the fragility of the internet's reliance on underfunded, volunteer-maintained code, prompting calls for businesses to treat open-source security as a critical investment.