Across the world on Wednesday, governments and security agencies moved together to contain a flaw that had hidden inside PHP, the quiet language beneath countless websites, for more than a decade. It is a reminder that much of the digital world rests on old foundations that few people ever see, and that the tools able to examine those foundations are changing faster than the habits of those who maintain them. The discovery came from artificial intelligence, and the response now rests with the many small hands that keep websites running.
AI Uncovers Decade-Old PHP Flaws, Sparking Global Cyber-Security Scramble
The bugs weren't new; what changed was our ability to find them.
Mark
Why is a programming language most people have never heard of causing this much alarm?
Mimi
Because it sits underneath so much. Online shops, Wikipedia, WordPress blogs all rely on PHP, and the flaw could let attackers take over a web server without logging in.
Mark
Which organisations have actually pulled sites offline?
Mimi
Wikimedia took some systems down, and the Finnish government, Edinburgh council and the BBC removed sites or pages. The Dutch cyber-security agency and several Scottish councils and health boards did too.
Luke
Let me flag the scale. "Millions and millions" of websites is one executive's estimate, not a measured count.
Mimi
Fair. Paul Spain offered it as an estimate, and the reporting doesn't give a verified number of affected sites.
Luke
And "most severe ever found by AI" is Wiz's own description, from a company involved in the discovery.
Mark
So what is firmly established?
Mimi
That patches were released Wednesday, that the NSA and the UK's NCSC urged immediate patching, and that details leaked this week, forcing a rushed announcement.
Luke
Do we know whether anyone has exploited it yet?
Mimi
The reporting doesn't say. Kanhere expects more attempts in the coming weeks, but that is a forecast, not a confirmed attack.
Mark
What should ordinary users do?
Mimi
Watch for security advice from services they use, such as password-change requests, and be careful with phishing messages riding on the news.
The Pulse
- Serious PHP flaws that went unnoticed for over a decade could let attackers seize web servers and reach sensitive data without any login.
- Details leaked online before the planned announcement, forcing developers to rush out patches and disclose the scale of the problem.
- Wikimedia, the Finnish government, Edinburgh council, the BBC and Dutch cyber agency pulled sites offline while patches were prepared.
- US and UK security agencies told organisations to patch immediately or take systems down, and Japan's prime minister urged checks tonight.
- Experts expect more exploit attempts and phishing in the coming weeks, with poorly maintained smaller sites most exposed.
Across the world on Wednesday, governments and security agencies moved together to contain a flaw that had hidden inside PHP, the quiet language beneath countless websites, for more than a decade. It is a reminder that much of the digital world rests on old foundations that few people ever see, and that the tools able to examine those foundations are changing faster than the habits of those who maintain them. The discovery came from artificial intelligence, and the response now rests with the many small hands that keep websites running.
On Wednesday, governments and cyber-security agencies around the world moved at once to contain a set of serious flaws in PHP, the programming language that has powered websites since the 2000s. The flaws had sat unnoticed for more than a decade. This time, it took artificial intelligence to find them.
Most people have never heard of PHP, yet they meet it daily through online shops, Wikipedia and WordPress blogs. The flaws could let attackers take control of affected web servers without authentication and steal sensitive data, and one expert estimated they could touch "millions and millions" of sites. Researchers at Calif and Wiz found them using AI tools that analyse code far faster than people can. The details leaked online before PHP's developers were ready, forcing a rushed announcement.
The response was immediate. Wikimedia took systems down as a precaution, while the Finnish government, Edinburgh council, the BBC and the Dutch cyber-security agency pulled sites offline. PHP's developers released patches and urged every user to update at once. The US National Security Agency told organisations that could not patch quickly to take systems offline, and the UK's National Cyber Security Centre warned them to check for backdoors. In Japan, Prime Minister Sanae Takaichi asked people to check their public sites that night.
Researchers stressed that the bugs were old; what had changed was the ability to find them. Experts warned that smaller organisations with limited resources are most exposed, and that attacks are likely to rise now that the technical details are public. Users were advised to watch for password-change requests from the services they use and to be wary of phishing messages exploiting the publicity.
On Wednesday, governments and cyber-security agencies around the world moved at once to contain the fallout from a set of serious flaws in PHP, a programming language that has been used to build websites internationally since the 2000s. The flaws had gone unnoticed for more than a decade. It took artificial intelligence to find them.
Most people have never heard of PHP, short for PHP: Hypertext Preprocessor, but they run into it every day. It powers online shops, Wikipedia and WordPress, the content management system behind many blogs and other sites. Paul Spain, chief executive of Gorilla Cyber Security, told the BBC that when you visit a site like Wikipedia, PHP is the code that gathers the information you need and presents it in readable form. The flaw could allow attackers to take control of affected web servers without authentication and steal sensitive data. Spain estimated it could affect "millions and millions" of websites.
The vulnerabilities were found by researchers at the security firms Calif and Wiz, using advanced AI tools that can analyse code and find flaws far faster than humans or older systems. Wiz called them the "most severe" ever detected by AI. OpenAI, whose technology was used in the discovery, described it as "one of the most impactful security issues in recent memory." Details leaked online this week, which forced PHP's developers to rush out their announcement of the flaws and their scale.
The disruption was global and immediate. Wikimedia, the organisation behind Wikipedia, took a number of its systems down as a precaution. The Finnish government, Edinburgh council and the BBC took sites and pages offline, and the Netherlands' cyber-security agency pulled its website. A number of Scotland's public bodies, including councils and health boards, did the same. The alert affected services from gaming platforms to government portals and online forums.
PHP's developers released patches on Wednesday and said all users were strongly encouraged to update immediately. Agencies echoed the message. The US National Security Agency told every organisation using PHP to take systems offline if they could not patch at once, warning that the flaw could give a "direct path" into a system's database. It said the risks were serious enough to require immediate patching across US government departments and agencies. The UK's National Cyber Security Centre gave similar advice and told organisations to check for "backdoors installed by an attacker." Counterparts in the EU and Australia issued comparable alerts.
Japanese Prime Minister Sanae Takaichi urged people to check whether their public websites ran on PHP. Writing on X, she made an "urgent request for everyone to take action tonight," and said that if patching promptly was difficult, temporarily suspending websites could be an effective way to reduce risk.
Researchers stressed that the bugs themselves were old. Salil Kanhere of UNSW Sydney said they weren't new; what changed was the ability to find them. Ryan Ko of the University of Queensland's Cyber Research Centre said many such flaws stem from software built in the past for functionality rather than security. OpenAI said the episode shows AI can uncover security flaws but can also help attackers rapidly develop offensive tools and exploits. It said it had released a program to check whether PHP is secure. Jill Slay of the University of Adelaide said it would be "disastrous" if hackers or countries weaponised the flaw and seized private data.
The risk is uneven. Some experts warn that poorly maintained sites, especially those of smaller organisations with limited security resources, are most exposed. Kanhere expects more attempts to exploit the flaws in the coming weeks now that the technical details are public. The onus falls mainly on website operators, he said, but users should watch for security advice from affected services, such as requests to change passwords, and be wary of phishing messages that exploit the publicity around the incident.
Notable Quotes
We have an urgent request for everyone to take action tonight.— Sanae Takaichi, Japanese Prime Minister, on X
The flaw could provide a "direct path" to exploit a system's database.— US National Security Agency
Want the full story?
Read the original at BBC ↗
Technology