Brazil's telecom regulator Anatel and at least three federal courts this week suspended external access to the SEI, the electronic system that handles administrative case files across the federal government, after the disclosure of two serious security flaws in PHP, one of the most widely used programming languages on the internet. The vulnerabilities had gone unnoticed in the software for more than a decade and were brought to light with the help of artificial intelligence, triggering a global alert: governments from Finland to Japan took websites offline as a precaution, and security agencies in several countries demanded immediate fixes, according to reporting by g1 and BBC News Brasil.
To grasp the scale, think of PHP as the internet's invisible waiter: when you open a site like Wikipedia, it is the code that walks to the server's "kitchen", fetches the information and serves it on your screen. Public rankings put the language behind roughly 70% of websites, Thiago Ayub, technology director at Sage Networks, told g1. The flaw lets an attacker take over a server without a login or password and steal confidential data. In practice, it is like learning that the locks on millions of doors installed years ago can all be opened with a master key that anyone can copy.
The flaws were first reported in August, independently and on the same day, by security firm Calif and by OpenAI, the company behind ChatGPT. Cloud security company Wiz later said it had found additional ways to exploit the vulnerabilities using Google's Gemini 4 Argon and OpenAI's GPT-5.6 Sol models. The companies reached for superlatives: Wiz called the flaws the "most serious" ever detected by AI, and OpenAI described the finding as "one of the most impactful security problems in recent history". The incentives are worth noting: Wiz sells security services, and OpenAI and Google want to prove their models are useful beyond chat. Government agencies independently endorsed the alert, so the risk is real. The marketing tone, though, also serves those commercial interests.
In Brazil, Anatel temporarily suspended external access to the SEI and its other online services as a preventive measure. The federal regional courts of the 1st, 4th and 6th regions, which hear appeals in Brazil's federal justice system, confirmed similar steps. "The measure is preventive and aims to protect the system and the integrity of institutional information," said the TRF1 court, which gave no date for restoring external access. The federal government's Integrated Cybersecurity Center (CISC) issued an alert on Wednesday (21) ordering public bodies to update the software immediately. g1 asked the Superior Electoral Court whether the flaws affect election-related systems and was still awaiting a reply. No major incidents have been reported in Brazil so far, according to experts consulted by the outlet.
Abroad, the reaction was just as fast. The US National Security Agency told organizations to patch the flaw or shut down vulnerable systems and said the risk requires immediate fixes across all federal departments and agencies. The United Kingdom advised checking for "backdoors installed by an attacker", and similar alerts came from the European Union, Singapore and Australia. In Japan, Prime Minister Sanae Takaichi wrote on X: "We have an urgent request for everyone to take action tonight." Wikimedia, Finland's government, the Edinburgh city council and the BBC itself are among those that took sites offline for a period. In France, even the Paris police prefecture's website became unreachable at the request of the national cybersecurity agency. PHP's maintainers released fixes on Wednesday and urged all users to update immediately.
What we still don't know
Nobody knows whether hackers exploited the flaws during the years they went unnoticed. The technical details are only now becoming public, and exploitation attempts are likely to rise in the coming weeks, researcher Salil Kanhere of UNSW Sydney told the BBC. The biggest concern is small, poorly maintained websites run by organizations without security teams, which may be slow to update or may not even know they use PHP.
The practical takeaway: if you run a website, especially on WordPress, Moodle or Magento, all built on PHP, the maintainers' guidance is to apply the update now or take the page offline temporarily, as Anatel and the courts did. If you are simply a user, there is little to do beyond checking whether the services you rely on are back online and following their official statements.