The bugs affect the PHP runtime itself, the software that processes web requests, rather than any particular website or plugin. Cloudflare's technical write-up describes both as memory-handling errors: when a request fails partway through, PHP may use data that was never fully set up, or memory that has already been released. Specially crafted HTTP requests can trigger those conditions. Because the flaws sit in the runtime, updating website code or plugins alone does not fix them; administrators must update PHP itself, or ask their hosting provider to do so. Gina Peter Banyard, a PHP developer, said patching is the only mitigation.

The leak gave attackers a head start. Amazon said it observed an exploitation attempt four days before the patches were released, and the flaws are now being broadly exploited in the wild, according to the company. Cloudflare, which deployed firewall protections roughly nine hours ahead of public disclosure, reported seeing attack traffic in which attackers mutated payloads to try to bypass its rules. Sansec had predicted mass attacks within 15 minutes of the patch release.

The reach is unusually wide. PHP is estimated to power around 70 percent of websites, and Wordfence warned that every WordPress site is exposed because WordPress runs on PHP servers. The flaws were discovered by researchers at Calif and Wiz with help from OpenAI and Google models, having gone undetected for more than a decade. OpenAI called the findings, which it helped verify, one of the most impactful security issues in recent memory. The NSA and the UK's National Cyber Security Centre urged organisations to patch immediately or take affected systems offline, and some governments in Europe were reportedly taking sites offline while they patched.