Artificial intelligence has once again made the world panic. It was used to find a serious vulnerability in the PHP code. This bug quietly existed there for over 10 years (starting with PHP 5.4) until the cybersecurity research team Wiz Research, armed with Open AI tools, found it in August 2026 and handed it over to PHP developers to close the hole.
Artificial intelligence has once again made the world panic. It was used to find a serious vulnerability in the PHP code. This bug quietly existed there for over 10 years (starting with PHP 5.4) until the cybersecurity research team Wiz Research, armed with Open AI tools, found it in August 2026 and handed it over to PHP developers to close the hole.
Until October 20, only a limited circle of researchers and PHP developers knew about the existence of this hole. But, as is usually the case, unfortunately, a data leak occurred.
The PHP Foundation wanted to release patches slowly and publicly announce the issue later in October, to give large organizations time to prepare. That didn’t work. They had to quickly release the update on October 21st.
That is, a temporary situation arose when the hacking instructions were already publicly available from hackers, and the site administrators had just learned about the problem and received an update.
It was during this window, when the threat had already become widespread and patches were still being deployed on servers, that government agencies around the world began to massively shut down their public services in order to proactively protect them from possible hacking.
Some European countries turned off state resources, turned off individual BBC systems, and Wikipedia projects.
In France, for example, the websites of local authorities (prefectures) managed by the Ministry of the Interior and the website of the Paris police prefecture were turned off, as well as certain websites and applications of the telecom company Orange SA, the government portal.
And for good reason. Cloudflare recorded massive (millions) network scans and the first attempts by hackers to automatically attack all websites in a row.
Japanese Prime Minister Sanae Takaichi even urged people to check if their public websites are running PHP. The post has been viewed 96 million times.
In fact, about 70% of the world’s websites run on PHP. And the problem lies not in your website or plugins (like WordPress or Drupal), but in the "foundation" itself — the internal code of the PHP interpreter, which processes user requests on the server. An attacker can remotely execute any program code on the server without your knowledge. This allows hackers to gain complete control over the server, steal databases, delete files, or use the website to attack others.
It looks really scary.
And the question immediately arises: what about PHP websites in Ukraine? Why did Europe panic, but here it is quiet?
All I saw: The State Emergency Response Team (CERT-UA) issued a warning (at noon, already October 22):
"We strongly recommend that you update PHP on supported branches to the patched versions as soon as possible and restart PHP services (systemctl restart php-fpm). This is the only proven and reliable way to be fully protected."
I don’t know how many people saw it. But for some reason I think it was not many. I also don’t think it’s news of the level of Zelensky’s speech, but our government, its head, and the rest, the relevant ministry should definitely issue a warning.
I didn’t find that.
As the hosting service HyperHost wrote in its Facebook comment: the situation in the Ukrainian segment is not a lack of reaction, but an indicator of high-quality and systematic work. "The difference in approaches: while some European providers have chosen the radical path of turning off services or transferring sites to maintenance mode (HTTP 503), an infrastructure properly protected by WAF filters allows such threats to pass without any downtime for customers," the service commented.
I would like to believe that.
But there is another explanation for why we haven’t had anything fall yet. It was given to me by cybersecurity expert Andriy Baranovich (Sean Townsend): despite many attempts by attackers, there is no working exploit (i.e., a website killer program) yet.
"He could appear at any moment," says Andriy.
What this literally means for us: as soon as this happens, we will almost immediately find out what the Ukrainian silence was for us: a good level of preparation, or vice versa — negligence.
It hasn’t rained yet. And that’s good. But it’s far from a fact that it won’t rain tomorrow.
What should be done?
Here is a simple recommendation from Sean Townsend: "Update PHP or disable features related to the vulnerability at the configuration level (but it’s better to update). This is easy to do if you have a Wordpress bucket. And if it’s a large service, it’s a real pain."
So don’t delay!
