Beneath the ordinary machinery of the internet, the code that powers more than seven in ten websites, from encyclopaedias to shopping carts, has been found to hide serious weaknesses that sat unnoticed for years. It took artificial intelligence tools to bring them to light, and now governments, security agencies and the developers of the PHP platform are working to close the gaps. The lesson being drawn is less about one software flaw than about how quickly the discovery of hidden fragility can now outpace the human habit of waiting to be told.
AI Uncovers Major Flaw in PHP, Powering Over 70% of Websites, Prompting Global Patch Rush
Flaws that had been lurking in the software for years
Mark
Why does a flaw in PHP matter so much?
Mimi
Because PHP powers more than 70% of websites, including Wikipedia and shopping sites. A weakness there is a weakness across a huge part of the web.
Mark
And it had been there a long time?
Mimi
Years, according to the report. Nobody caught it until AI tools found it.
Luke
Worth noting that the report says the flaws existed for years, but not how long exactly, and not whether anyone exploited them in that time.
Mark
Wiz called it the most severe ever detected. That's strong.
Luke
It is, but it's Wiz's own assessment. OpenAI's line about one of the most impactful issues in recent memory is also a company characterisation, and OpenAI's technology found the flaws, so it has an interest in the story.
Mimi
Fair, though both statements point the same way, and governments are responding.
Mark
What should an ordinary person take from this?
Mimi
The patches exist. The risk is in the delay before sites install them.
Luke
And what we don't know is how many sites are still unpatched, or what the flaws let an attacker do. The summary doesn't say.
O Pulso
- Flaws in PHP, the platform behind over 70% of websites including Wikipedia, have been uncovered by AI tools after lying dormant for years.
- Governments and cyber-security agencies worldwide are scrambling to contain the threat across a huge swath of online shopping and public sites.
- PHP's developers have released patches, but every site must install them before it is protected, leaving a dangerous window of exposure.
- Security firm Wiz calls the flaw the most severe it has ever detected, and the race is now between defenders applying fixes and attackers seeking to exploit them.
Beneath the ordinary machinery of the internet, the code that powers more than seven in ten websites, from encyclopaedias to shopping carts, has been found to hide serious weaknesses that sat unnoticed for years. It took artificial intelligence tools to bring them to light, and now governments, security agencies and the developers of the PHP platform are working to close the gaps. The lesson being drawn is less about one software flaw than about how quickly the discovery of hidden fragility can now outpace the human habit of waiting to be told.
Governments and cyber-security agencies around the world are working to contain a serious flaw in PHP, the software platform that runs more than 70% of websites. Among the sites that rely on it are Wikipedia and a great many online shops. The weaknesses were found by artificial intelligence, and they had been sitting in the code for years before anyone noticed.
PHP's developers have released patches, but a patch protects no one until the people running each site install it. That gap between publication and installation is where the danger lies, because attackers can exploit the flaws in the meantime.
The cyber-security firm Wiz has called the issue the most severe it has ever detected, and OpenAI, whose technology helped find the flaws, described it as one of the most impactful security issues in recent memory. These are the companies' own assessments rather than independent measurements, though they come from those closest to the work.
The available reporting, a short BBC video piece with a brief written summary, does not yet say how many sites are affected, what an attacker could do with the flaws, or whether any attacks have already occurred. What is clear is the outline: a widely used piece of infrastructure carried weaknesses for years, an AI tool surfaced them, and a coordinated response has followed. What comes next will show whether sites patch in time, and how far AI-driven discovery reshapes security work, since the same capability could be turned by others to search for similar flaws.
Governments and cyber-security agencies around the world are working to contain a serious flaw in PHP, the software platform that runs more than 70% of websites. Among them are Wikipedia and a large number of online shopping sites. The problems were found by artificial intelligence, and they had been sitting in the code for years before anyone noticed.
PHP's developers have now released patches to fix the vulnerabilities. A patch only protects a site once its operators install it, and that is where the urgency lies. The flaws could be exploited by hackers, so the gap between a fix being published and a fix being applied is the period of greatest exposure.
Two of the organisations involved have used unusually strong language. The cyber-security firm Wiz described the issue as the most severe it has ever detected. OpenAI, whose technology was used to find the flaws, called the discovery one of the most impactful security issues in recent memory. Both statements are characterisations by the companies, not independent measurements, but they come from parties close to the work.
The BBC's technology correspondent, Joe Tidy, has reported on how the discovery happened and what it means for ordinary internet users. The source report is a short video piece, and the written summary that accompanies it does not set out the technical details. It does not say how many sites are affected, what exactly the vulnerabilities allow an attacker to do, or whether any attacks have already taken place.
What the summary does establish is the shape of the event. A widely used piece of internet infrastructure carried weaknesses for years. An AI tool surfaced them. A coordinated response by governments, security agencies and developers followed, ending in patches.
The next stretch will show whether attackers manage to exploit the flaws before sites apply the fixes. It will also show how far AI-driven vulnerability discovery changes the way security work is done, since the same capability that found these flaws could in principle be used by others looking for them.
Citações Notáveis
OpenAI called the discovery one of the most impactful security issues in recent memory.— OpenAI
Wiz described the issue as the most severe ever detected.— Cyber-security firm Wiz
Quer a matéria completa?
Leia o original em BBC News ↗
Technology