A severe vulnerability has been found in key web technology PHP, forcing just about everybody to patch websites, and fast. Expect outages.

Over the next couple of days, there will be more complaints about websites being down than usual. It's not just you, but the effects of the Internet relying on PHP and something going horrifically wrong.

The developers behind PHP, a web programming language, have said they will release a patch on Wednesday to fix a pair of vulnerabilities. They are rated at a very high 9.2 severity on the CVSSv4.0 severity scale.

The people behind the patch say that users should "upgrade as soon as the release is available," reports Reuters.

It is severe enough of a problem that EU cybersecurity officials have warned companies and organizations that can't apply the fixes must be prepared to take websites using PHP offline temporarily.

The EU Computer Emergency Response Team (CERT-EU) describes it as a risk of unauthenticated remote code execution. An attacker can insert code and run it on a vulnerable server.

The Australian Cyber Security Centre (ACSC) has issued similar guidelines, advising to identify PHP servers and to apply patches, as well as to monitor for malicious activity.

While the ACSC wasn't aware of any active exploitation of the vulnerabilities, but Cloudflare CTO Dane Knecht said attacks were emerging. Cloudflare has updated its firewall rules as a temporary measure.

A very big deal

PHP (PHP: Hypertext Preprocessor or Personal Home Page) is a scripting language used in website development. It has been used for decades online, being one of the oldest technologies used to create interactive websites.

It is so popular that it has been used for many different platforms and purposes online, besides being used as a page scripting language.

Platforms including Drupal, Joomla, and Magneto heavily use PHP. So does WordPress, a blogging platform that is heavily used online by websites, including many that don't look like blogs.

In short, PHP runs many of the things that run the web, and this is a big problem.

This is a situation made worse by AI, which is being used to find vulnerabilities that hackers can exploit, or simply use AI to hack on their behalf.

End users do not have anything they can actually do about patching, unless they happen to have a personal web server using PHP. There are no patches needed for browsers or applications.

Really, all web users can do is hope that the patching and inevitable downtime don't take too long, and that the patches work.

You may want to keep a good book on standby to stave off boredom.