WASHINGTON, D.C. — A global wave of website outages has been triggered by a critical PHP vulnerability, prompting security agencies to issue an emergency patch that could affect millions of sites, according to officials.

Officials estimate that more than 1.3 million web properties, representing roughly 5 % of global internet traffic, have been forced offline since the vulnerability was first reported. The flaw, identified by an AI-driven code‑analysis tool, allows attackers to inject arbitrary PHP code without authentication, a capability that has never been seen in previous PHP security incidents.

KEY POINTOfficials estimate that more than 1.

“The scale of the impact is unprecedented. We’re looking at a flaw that can bypass all existing authentication layers on the most common PHP frameworks,” said Alexandra Ruiz, senior threat analyst at SecureOps. “This is a wake‑up call for enterprises that still rely on legacy PHP stacks.”

Enterprises that have adopted PHP for their front‑end and API layers are scrambling to patch or migrate. Analysts say that about 37 % of Fortune 500 companies use PHP in at least one core application. The patch, released by the PHP Development Team, covers 94 % of the 1.4 million actively maintained PHP versions, but older releases remain vulnerable.

While the emergency update is being rolled out, cybersecurity firms report that some servers are still taking up to 48 hours to apply the patch due to legacy dependencies. The incident has intensified discussions about moving to newer languages such as Go and Rust, which have built‑in memory safety features that reduce the risk of similar vulnerabilities.

In light of the breach, several vendors are offering free security audits to their clients, and regulators are demanding that firms disclose any PHP‑based systems that remain unpatched. The incident underscores the need for continuous monitoring and rapid response capabilities in the era of AI‑driven threat discovery.

Key Takeaways

• 1.3 million sites affected, covering 5 % of global traffic.
• PHP patch covers 94 % of active versions; older releases remain at risk.
• Enterprise shift toward safer languages gaining momentum.

As the internet grapples with the fallout, industry leaders emphasize that the most effective defense will combine swift patching, robust monitoring, and a move away from legacy codebases that are hard to secure against modern AI‑powered attacks.