The PHP vulnerability has prompted businesses and governments to rush to patch systems after the flaw was disclosed on Wednesday.
The US National Security Agency warned attackers could use the bug to take control of web servers, steal data and disrupt services.
Security experts said software providers and organisations running customer-facing services must patch quickly and verify whether systems have been compromised.
A security flaw in PHP has pushed businesses and governments into a rush to patch systems after news broke on Wednesday that the coding language behind roughly 70 per cent of websites was vulnerable. The issue matters far beyond software teams because PHP sits under many everyday online services that most users depend on without knowing it.
The US National Security Agency warned that attackers could use the flaws to take control of web servers, steal data, disrupt services or move through wider networks. That means the risk is not limited to one website or app—it could spread across connected systems if organisations fail to fix the problem quickly.
Experts said the main responsibility lies with software providers and the organisations that run customer-facing services. Still, they added that users should tighten basic protections, watch their accounts and stay alert for follow-up scams that often trail major cyber incidents.
What Users Can Do
Use stronger sign-ins first. Multi-factor authentication, or MFA, asks for two checks before access is granted, such as a password and a text message code or a security key.
Emily Austin, principal security researcher at Censys, recommended using unique passwords for individual websites and monitoring transactions for unusual activity. Those steps can reduce damage if one service is exposed or if login details are stolen elsewhere.
“But realistically, for situations like the PHP vulnerabilities, there really isn’t much an end user can do beyond hope the services they rely on either don’t use PHP or have people actively working on patching,” Austin said.
Update Devices Automatically
Automatic updates matter. Dan Guido, CEO and co-founder of Trail of Bits, recommended that people “turn on automatic updates for your phone, computer, and home router.”
Companies usually issue security updates when patches are ready for known vulnerabilities. Installing them quickly narrows the time available for attackers to exploit exposed systems. Even then, Guido warned that consumers still depend on how well the services they use protect their own infrastructure.
“Someone visiting a website can do everything right, like use two-factor authentication, and still have their information exposed,” Guido said. “You can't patch your hospital's website.”
Runa Sandvik, founder of Granitt and a digital security expert, said people should install app and service updates as soon as they are available. She added that internet-connected devices at home need the same attention, and users should ask the vendor whether updates exist.
“I can see a scenario in which some people have some sort of IoT device at home that maybe doesn't get frequent updates, maybe doesn't get any updates at all,” Sandvik said. “It's worth double checking with the vendor to see if there is anything available.”
Patch And Verify
For organisations, the advice is more direct. Dr. Daniel Gardham, a lecturer at the Surrey Centre for Cyber Security and the University of Surrey, said they must know what software they run, patch promptly and check whether systems have already been compromised.
The PHP flaws add to a run of serious software bugs that large language models have helped expose. Weak spots buried in widely used code were once too hard for people to find or use, but they are now far easier to uncover and turn into attacks.
“Finding vulnerabilities is becoming faster and easier, but fixing them across the range of systems that rely on this software is much harder,” Gardham said. “How well organizations manage that gap will determine whether AI makes the internet safer or more vulnerable.”
Watch For Scams
Scammers move fast. Nic Adams, co-founder and CEO of 0rcus, a cyberkinetics company, warned that cybercriminals often exploit confusion after major security headlines.
He advised people to avoid unsolicited links. “When these headlines hit, check the affected company's instructions by opening its app or typing its website address yourself,” Adams said. “An urgent message telling you to 'secure your account' deserves extra scrutiny.”
Banking And Shopping
Banks have been preparing for this moment since frontier models came out, and have “worked extremely hard to ensure there is no more low-hanging fruit for the bad guys to go after,” said Paul Benda, executive vice president of risk, fraud and cybersecurity at the American Bankers Association.
However, Benda added, “we are in a new normal” in terms of cyber threats, and consumers need to be aware, especially in the wake of the PHP vulnerabilities, when shopping with random retailers or websites “where their security is not going to be as good as your bank.”
Benda said shoppers should avoid using the same password on different retail sites. He also urged them to use passkeys where they can. Passkeys are digital keys tied to specific websites, so users do not type a password into the site and face less risk from phishing.
With inputs from Reuters
