Across the web's quiet machinery, a language that has silently built millions of pages since the early 2000s has been found to hide serious flaws that went unnoticed for over a decade. It took a new kind of artificial intelligence, able to read code faster than any human reviewer, to bring them into the light. On a single Wednesday, governments, a national broadcaster, Wikipedia's parent organisation and local councils all stepped back from their own pages, a reminder of how much of daily life rests on foundations no one thinks about until they tremble. The episode asks an old question in a ne
AI Uncovers Decade-Old PHP Flaws, Triggering Global Cyber-Security Scramble
The bugs weren't new; what changed was our ability to find them.
Mark
Why did this set off such a wide response?
Mimi
Because PHP sits under so much of the web. Wikipedia, WordPress, online shops. The flaw could let attackers take over servers without logging in and steal data.
Mark
And the NSA went as far as saying take systems offline.
Mimi
Yes, if you can't patch immediately. Japan's prime minister said something similar, that suspending sites can be an effective way to reduce risk.
Luke
Let me separate a few things. "Millions and millions" of sites is Paul Spain's estimate, not a measured count.
Mark
So we don't know how many are actually vulnerable.
Luke
Not from this reporting. Same with "most severe ever detected by AI". That's Wiz's description, and Wiz helped find the flaws.
Mimi
The bugs themselves weren't new, according to Salil Kanhere. What changed was the ability to find them.
Mark
Has anyone actually exploited this?
Luke
The reporting doesn't say. It says more attempts are likely now that details are public, which is a prediction, not an observation.
Mimi
And the details leaked this week, which forced the developers to announce early.
Mark
What should ordinary people do?
Mimi
Mostly wait on operators to patch, watch for password-change requests from affected services, and be careful with phishing that uses the news as bait.
The Pulse
- Flaws in PHP, the quiet engine behind Wikipedia and countless WordPress sites, could let intruders seize web servers and drain sensitive data without needing to log in.
- Details leaked before most operators were ready, forcing PHP's developers to rush out patches and urge every user to update at once.
- Governments from Washington to Tokyo issued emergency warnings, with some advising organisations to take systems offline if they cannot patch immediately.
- Wikimedia, the Finnish government, Edinburgh council and Scottish health boards pulled services down as a precaution, while the BBC itself removed pages.
- Smaller organisations with thin security budgets are most exposed, and experts expect exploit attempts to climb in the coming weeks as technical details spread.
Across the web's quiet machinery, a language that has silently built millions of pages since the early 2000s has been found to hide serious flaws that went unnoticed for over a decade. It took a new kind of artificial intelligence, able to read code faster than any human reviewer, to bring them into the light. On a single Wednesday, governments, a national broadcaster, Wikipedia's parent organisation and local councils all stepped back from their own pages, a reminder of how much of daily life rests on foundations no one thinks about until they tremble. The episode asks an old question in a new form: whether software built for function, not defence, can ever be fully trusted, and whether the same tools that expose our weaknesses will also be used against us.
On Wednesday, a remarkable sight unfolded across the digital landscape. The Finnish government, Edinburgh council, the BBC and the Netherlands' cyber-security agency all pulled pages or whole websites offline. Wikimedia, the organisation behind Wikipedia, shut down a number of its systems as a precaution, and several Scottish councils and health boards followed. The cause was a set of flaws in PHP, a programming language that has quietly powered websites around the world since the 2000s.
The flaws had hidden in plain sight for more than a decade. They were uncovered by researchers at the security firms Calif and Wiz, who used advanced AI tools able to analyse code far faster than people or older systems. Wiz called the result the most severe set of flaws ever detected by AI, and OpenAI, whose technology played a part, described it as one of the most impactful security issues in recent memory.
Most people use PHP every day without knowing it. It runs online shops, Wikipedia and WordPress, which underpins many blogs. Paul Spain of Gorilla Cyber Security estimated the flaw could affect "millions and millions" of sites, since it could let attackers take control of servers without authentication and steal private data. Jill Slay of the University of Adelaide warned that weaponised, it would be "disastrous."
When the details leaked this week, PHP's developers had to publish patches in a hurry, urging everyone to update immediately. Governments followed. The US National Security Agency advised any organisation unable to patch at once to take its systems offline. In Japan, Prime Minister Sanae Takaichi asked people to check whether their public websites ran on PHP that very night, and said temporarily suspending sites could be a sensible safeguard.
Researchers stress that the bugs themselves were not new; what changed was the ability to find them. Modern software is complex enough that flaws can linger for years, and many were written for function rather than security. For now, the responsibility rests mainly with website operators, particularly smaller groups with limited resources. Ordinary users are advised to heed requests to change passwords and to beware of phishing messages that trade on the publicity.
On Wednesday, the Finnish government, Edinburgh council, the BBC and the Netherlands' cyber-security agency all pulled pages or entire websites offline. Wikimedia, the organisation behind Wikipedia, took down a number of its systems as a precaution. A number of Scottish councils and health boards did the same. The cause was a set of flaws in PHP, a programming language that has been used around the world since the 2000s to build websites.
The flaws had gone unnoticed for more than a decade. What brought them to light was artificial intelligence. Researchers at the security firms Calif and Wiz used advanced AI tools that can analyse code and spot weaknesses much faster than people or older systems can. Wiz described the result as the most severe set of flaws ever detected by AI. OpenAI, whose technology was used in the discovery, called it one of the most impactful security issues in recent memory.
Most people have never heard of PHP, but they use it daily. It powers online shops, Wikipedia and WordPress, the content management system behind many blogs and other sites. Paul Spain, chief executive of Gorilla Cyber Security, explained to the BBC that when you visit a site like Wikipedia, PHP is the code that gathers the information you need and presents it in readable form. The flaw could let attackers take control of affected web servers without authentication and steal sensitive data. Spain estimated it could affect "millions and millions" of websites. Jill Slay, a cyber-security researcher at the University of Adelaide, said it would be "disastrous" if hackers or countries weaponised it to seize private data.
The details leaked online this week, which forced PHP's developers to rush out their announcement. On Wednesday they released patches and told all users to update immediately. Governments followed with their own warnings. The US National Security Agency told every organisation using PHP to take systems offline if they could not patch at once, saying the flaw could give a "direct path" to a system's database. It said the risks were serious enough to require immediate patching across US government departments and agencies. The UK's National Cyber Security Centre gave similar advice and told organisations to check for backdoors installed by an attacker. Counterparts in the EU and Australia issued comparable alerts.
In Japan, Prime Minister Sanae Takaichi posted on X an urgent request for everyone to act that night, asking people to check whether their public websites ran on PHP. If a patch could not be applied promptly, she wrote, temporarily suspending sites could be an effective way to reduce risk.
Salil Kanhere, a cyber-security researcher at UNSW Sydney, said the underlying bugs were not new; what had changed was the ability to find them. Modern software is so complex, he said, that some vulnerabilities can stay hidden for years. Ryan Ko of the University of Queensland's Cyber Research Centre added that many such flaws stem from software built in the past for functionality rather than security. OpenAI said the episode shows how AI can uncover security flaws but also how it can help attackers quickly develop offensive tools and exploits. The company said it had released a program to check whether PHP is secure.
Some experts warn that poorly maintained sites, especially those run by smaller organisations with limited security resources, face the greatest risk. Kanhere expects more attempts to exploit the flaws in the coming weeks, now that the technical details are public.
The responsibility sits mainly with website operators, who are urged to move to the latest version of PHP. The NSA has called for heightened awareness over the coming weeks and close attention to vendor updates, saying vigilance in applying patches is paramount. Ordinary users should watch for security advice from affected services, such as requests to change passwords, and be wary of phishing messages that exploit the publicity around the incident.
Notable Quotes
We have an urgent request for everyone to take action tonight.— Sanae Takaichi, Japanese Prime Minister, on X
The underlying bugs weren't new; what changed was our ability to find them.— Salil Kanhere, UNSW Sydney
Want the full story?
Read the original at BBC News ↗
Technology