Security teams have disclosed legacy vulnerabilities in the PHP codebase, which AI played a critical role in discovering as flaws remained dormant in legacy C routines.
The PHP Security Team issued emergency action across all supported branches (versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35), triggering a precautionary website shutdown to contain the situation and leading to patch rollouts across widespread web infrastructure. Public agencies and major websites participated in a blanket website shutdown.
Following national security directives, administrators were urged to patch vulnerabilities quickly or temporarily take connected PHP servers down if they couldn’t be applied straight away.
All PHP installations are at risk and users are urged to act immediately to mitigate the risk in this way. Technical details are being made public and initial proofs of concept have already begun to be circulated which increases the threat that bad actors are already exploiting the vulnerabilities which can allow unauthenticated remote code execution.
Both flaws carry a CVSS score of 9.2+ and allow unauthenticated Remote Code Execution at the interpreter level, before application logic even executes.
In a statement posted to social media, the National Security Agency stated:
“Effective Immediately, all organisations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server’s file system or database. If an immediate update is not feasible, it is recommended that organisations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance”.
The discovery of these deep-seated legacy vulnerabilities by artificial intelligence underscores the urgent need for govtech modernisation initiatives to move beyond traditional code auditing. As public sector agencies increasingly embrace automated security scanning to protect critical digital infrastructure, these kinds of large-scale emergency patches highlight the growing intersection between advanced AI-driven threat intelligence and government cybersecurity resilience.
Tech in Gov Europe 2027 will take place on June 15-16, 2027, at the RAI Amsterdam in the Netherlands.
As Europe’s prominent event for public sector IT and executive professionals, it brings together government leaders, CIOs, CISOs, and tech providers to focus on digital transformation, cyber resilience, AI infrastructure, and critical digital infrastructure security. The conference is also launching alongside Identity Week Europe.
