A critical flaw affecting 70% of all websites has the cybersecurity world panicked

Ilya Pavlov / Unsplash Details have been published of a critical flaw in the programming language PHP, which is the backbone of more than 70% of all websites .

Left unfixed, the flaw would allow hackers to easily take over and compromise millions of websites and the information held on their servers.

In response, multiple European governments and operators including the Port of Rotterdam have taken websites offline.

The Australian Signals Directorate , America’s Cyber Defence Agency , and similar bodies from the United Kingdom, Europe and Japan have all warned web developers to apply urgent updates to their core systems, and to consider taking down websites until safety can be guaranteed.

The organisation behind the free, open-source language has published updates that patch the flaw, but performing the updates on the millions of systems that use PHP will take time.

What is PHP? PHP is often called “the backbone of the web”.

It’s a programming language – a way to give instructions to computers – that has been around since 1997, and it allows websites to manage user inputs and process information behind the scenes.

The power of PHP is its versatility.

Websites use it for everything from logging users into accounts and running online stores, to requesting data from databases and powering millions of blog posts and news sites.

PHP runs on the server rather than your personal computer.

This means most of us interact with PHP every single day without ever seeing it.

A timeline of concerns In August, a cybersecurity researchers from a company called Wiz used their own tools and the latest versions of Google’s Gemini and OpenAI’s ChatGPT AI models to trawl through PHP’s massive codebase .

The Wiz team were searching for hidden programming weaknesses that an attacker could chain together to take over a system running PHP simply by sending a carefully crafted request over the internet.

Within a few days, they found ways to break into PHP-powered systems from Drupal and WordPress which are used in huge swathes of the web.