A critical vulnerability in the PHP programming language has triggered millions of exploitation attempts worldwide, forcing governments and companies to yank their websites offline before attackers could take control. The US National Security Agency warned the flaw could allow server takeover, data theft, and service disruption — the full trifecta of web compromise. The scale of exposure is staggering: PHP underpins roughly 70% of the world's websites. That is not a market share figure to celebrate — it is a single point of failure baked into the architecture of the internet itself. When one language carries that much of the web's weight, a single code flaw becomes a systemic event, not a localized bug. Small businesses bore the sharpest costs. Many lacked the in-house expertise to patch quickly, leaving them to choose between staying online and exposed or going dark and losing revenue. The Guardian's own callout to affected small businesses underscores how unevenly the burden falls — large enterprises with dedicated security teams patched and moved on, while small operators scrambled. The vulnerability emerged on Wednesday. Within hours, cybersecurity firms were tracking millions of exploit attempts. The speed of weaponization highlights a persistent asymmetry: attackers can automate exploitation faster than most defenders can deploy patches. The window between disclosure and patch deployment is where damage concentrates. The deeper structural question is why so much of the web still runs on a single language runtime with this kind of attack surface. PHP's dominance is a legacy of accessibility and ecosystem inertia — WordPress alone accounts for a vast share of PHP's footprint. That dominance was never engineered for resilience; it accumulated through convenience. Governments pulling sites offline is the correct short-term response and a damning long-term signal. When nation-states treat a programming language patch as an emergency action, the infrastructure has a concentration problem that no single fix addresses. The pattern — monoculture, exploit, scramble, patch, repeat — has been running for decades with no structural correction. The NSA's involvement signals the national security dimension now attached to web infrastructure. PHP is not classified technology, but it runs enough government-facing services that a flaw in its codebase becomes a matter of state concern. The line between software maintenance and national defense continues to blur.
