70% of the Internet in Danger!

Critical flaws in PHP—the software behind about 70% of websites—have sent website operators scrambling to patch their systems. Here’s what you need to know.

Another week, another security headline. This one reaches into the machinery behind much of the web. Researchers uncovered critical vulnerabilities in PHP, a programming language that Wiz says powers about 70% of websites worldwide. AI-assisted research helped bring the danger into focus, and website operators have urgent work to do.

That 70% describes how widely PHP is used—not a count of websites confirmed hacked or still vulnerable. The risk depends on the software version, configuration and fixes installed. CERT-EU advises organizations to patch affected systems immediately.

First, an important distinction: a software vulnerability is not the same as a data breach. A weakness can exist without anyone stealing information. Website operators need to investigate and patch their systems. Meanwhile, there are sensible steps the rest of us can take.

Watch the Tony's Top Tech video

Watch the video below from Tony's Top Tech. If you find it helpful, give it a like and subscribe to the channel. You'll get more practical tech coverage without needing a dictionary to understand it. And unlike another password reset, subscribing takes only a moment.

Open the video on YouTube if it doesn't play here.

Start with your updates

Keep your phone, computer, browser, router and other connected devices up to date. Turn on automatic security updates when you can. Even a smart doorbell or television can need a software fix. Updating your devices won't repair a vulnerable website, but it helps protect the equipment you control.

Use different passwords for different accounts

If one password unlocks your email, shopping and banking, a problem with one account can spread to the others. A password manager can create and save strong, unique passwords. Use passkeys where they're offered, and turn on two-factor authentication for important accounts. An authenticator app or security key is often safer than relying only on text-message codes.

Give your email account extra protection

Your email account is often how you reset passwords elsewhere. Secure it with a strong password and two-factor authentication. Check your recovery information, recent sign-ins and email forwarding settings. If something looks unfamiliar, investigate it.

Be careful with unexpected calls and messages

Scammers can copy company websites and use AI to imitate voices. If a caller claims to be a relative who urgently needs money, hang up and call that person using a number you already have. A private family verification phrase can help, but it shouldn't replace calling back. For suspicious emails, open the company's official app instead of following a surprise link.

Three more things worth doing

Freeze your credit: In the United States, it's free to freeze your credit at Equifax, Experian and TransUnion. Back up important files: Keep a separate backup of photos and documents, and make sure you can restore them. Review connected apps: Remove browser extensions and third-party account access you no longer use.

You Won’t Believe the Rest of the Story

AI can help researchers find security flaws and help scammers make a convincing fake. The same technology that helps spot trouble can also dress it up. An urgent message still deserves a second look, no matter how polished it sounds.

You don't need to become a cybersecurity expert. Start with the accounts that matter most, install your updates, and be skeptical of messages that pressure you to act immediately. A few good habits can save you a lot of trouble.

We'll keep this story updated

As reliable new details and official security guidance become available, we'll update this report. We'll distinguish confirmed findings from rumors and won't call a vulnerability a confirmed breach without evidence.