Sri Lanka’s Computer Emergency Response Team has issued a critical alert over security flaws in PHP, the programming language behind a large share of the country’s websites, as organisations in several countries take their own sites offline rather than run them unpatched.

CERT told public and private sector organisations and website developers that the vulnerabilities could expose affected systems to unauthorised access, data theft and disruption of operations, the Daily Mirror reported on Thursday afternoon.

Its instructions are specific: identify every system running PHP, check which version is in use, and install the relevant security updates promptly, following the guidance published on the official PHP website. Newswire adds two further recommendations absent from the Daily Mirror’s account — review system logs for unusual activity, and restrict internet access to critical, high-risk systems that cannot be updated immediately.

The local alert is one arm of a global scramble

The Sri Lankan advisory reads as routine housekeeping. The international picture around it is not.

NewsFirst reported at 11.37 a.m. that governments and agencies worldwide have urged websites to address two critical flaws in PHP, with a fix issued on Wednesday afternoon. Agencies have told organisations that cannot patch in time to consider taking their sites down altogether.

Several have done exactly that. Finland has temporarily shut down its government’s public web services, and the Netherlands’ cyber-security agency took its own website offline. Edinburgh council and the BBC have pulled pages. Hiru News carried the same account in Sinhala at 12.14 p.m., reporting that institutions across many countries had temporarily disabled their sites.

The flaws were found by AI. The cyber-security firm Wiz described them as the “most severe vulnerabilities ever discovered” by the technology.

Why the exposure here is wide

PHP underpins a large proportion of Sri Lankan government, media and small-business websites, including most WordPress installations. An organisation that does not know which of its systems run PHP cannot act on CERT’s advice at all — which is why the first instruction is an inventory rather than a patch.

Update: the flaws have a name, and the outages are larger than first reported

Fuller international accounts published since the Sri Lankan alert give the picture the local filings left out.

The two bugs are known collectively as PHP2Shell. They were found by teams at OpenAI, Google-owned Wiz and a third security firm, Calif, and had sat undetected in PHP for more than a decade, CNN reported. Wiz says exploiting them required a chain of steps “at the edge of what human researchers could practically achieve” — researchers then used AI to adapt the exploit techniques and analyse the results, working with Google’s Gemini 4 Argon, Wiz Atlas and OpenAI’s GPT-5.6 Sol. One researcher, the firm says, “completed in a week what previously would have taken a world-class team months of work.”

The mechanism is a memory fault: when a web request ends unexpectedly, PHP can leave data behind in memory where it may later be read, corrupted or exposed. Patrick Fussell, global head of adversary simulation at IBM, put it to CNN as “a hotel room where you check out, but your key still works — and so you can just go back into that hotel room later, and now somebody else’s stuff is there.”

The bugs were found in late August and disclosed only on Wednesday, once the PHP Foundation had a patch ready. Cloudflare, which worked with the foundation and the three research teams, says the flaws allow remote code execution, service disruption and exposure of customer data; its chief executive said the company’s network had already seen millions of exploitation attempts within days of disclosure. Both the US National Security Agency and the EU Agency for Cybersecurity issued advisories urging immediate action.

Who went offline

The shutdown list is longer than the four names in the original account:

Wiz rates the episode alongside Heartbleed, the 2014 flaw in encryption software used by roughly two-thirds of the web.

Hiru News carried the same account in Sinhala on Thursday evening, crediting CNN. One figure differs: it reports close to 30 UK services down, where CNN says nearly three dozen — about 36.

Nigel Green, chief executive of the financial advisory firm deVere Group, framed the consumer exposure to CNN: “Booking platforms, marketplaces, subscription services, ticketing sites, delivery apps and utility portals could all be holding card details on systems built with the same kind of code.”

Update: a warning first raised in 2004

A later Sinhala filing recasts the timeline. Hiru News reported on Friday that the underlying weakness was first flagged in 2004 by security researcher Stefan Esser, who warned it could allow password theft, database access and full takeover of a site — and that the warning drew insufficient attention for 22 years.

That sits alongside, rather than replaces, CNN’s account that the two bugs went undetected for more than a decade: on Hiru’s telling, what was missing was not awareness of the weakness but a practical way to exploit it. Attacking it required a coding process too laborious and complex for human researchers to complete, which is why it stayed theoretical.

That barrier fell to AI. Researchers at the security firm Calif, working under OpenAI’s “Patch the Planet” programme, used a large language model to work out how to exploit the flaw in about two days, Hiru reported, dating the work to early August. Google-backed Wiz then found further attack methods. Because researchers reached it before attackers did, patches were prepared first.

Hiru puts PHP’s footprint at close to 70% of the world’s websites.

Prof. Vyas Sekar of Carnegie Mellon University told the outlet that AI has sharply cut the cost and time of attacking the internet through long-unresolved flaws of this kind, and that the episode may be only the beginning of a larger wave of cyber threats.

One detail is unresolved: Hiru dates the exploit work to early August, where CNN places the discovery in late August.

Not reported

No filing — Sri Lankan or international — gives CVE identifiers, a severity score or affected version numbers, so a local administrator still cannot tell which PHP releases are at risk or whether their own is among them. The name PHP2Shell identifies the pair of bugs but not the builds they affect. None sets a deadline.

No filing reports any Sri Lankan government, bank or utility website taken offline as a precaution, and CERT has not said whether any local system has been compromised, or whether it has contacted specific agencies directly. Given that Cloudflare is already recording exploitation attempts at scale, the absence of any local status report is the open question here.