A flaw found by AI, fixed under pressure
Security researchers at Calif and Wiz used artificial intelligence built by OpenAI to uncover two critical flaws in PHP, the programming language that runs a large portion of the internet. A fix was released on Wednesday afternoon. According to the firms, the flaws had escaped detection for more than a decade, and Wiz described them as the most serious vulnerabilities its AI had ever found. OpenAI called the issue one of the most consequential security problems in recent memory.[S1]
Wiz estimated that roughly 70% of the internet is affected, a figure the BBC said it could not independently confirm. The firms argued that frontier AI models made the search practical, allowing working exploits to be developed and adapted across many applications within hours. The European Union Computer Emergency Response Team said the risk scores assigned to the flaws point to the possibility of unauthenticated remote code execution, which could let attackers install malware and bring sites down.[S1]
Governments and institutions go dark
Finland took its government's public web services offline for the time being, and the Dutch cyber-security agency announced it was pulling its own site down because of the flaws. Websites belonging to the Dutch National Institute for Public Health and the Environment and the Tweede Kamer, the lower house of the Dutch parliament, were also unreachable. The US National Security Agency, posting on X, told organizations that could not install the fix to take their systems offline, while the White House said federal agencies were cooperating with top AI labs to speed up a solution.[S1]
Japan's Prime Minister Sanae Takaichi urged people to check whether publicly available websites ran on PHP. The Wikimedia Foundation, which operates Wikipedia, said it was addressing the vulnerabilities and had taken down a number of other systems as a precaution until they could be safely patched, leaving some users unable to reach parts of Wikipedia on Wednesday. Edinburgh council's website became inaccessible, as did the online homes of several BBC programmes including Doctor Who and The Traitors, though no link to PHP was confirmed. The art platform DeviantArt said it was temporarily down for maintenance without giving a reason.[S1]
Understand this article deeper
Patching a language that is everywhere
Britain's National Cyber Security Centre, joined by agencies in the EU and Australia, called on PHP users to install the fixes, adding that organizations unable to patch right away should weigh shutting systems down until full mitigation is possible. Japan's national cyber-security office and EU officials gave comparable advice. According to security company Huntress, PHP runs quietly behind WordPress, Drupal, Joomla and Magento sites, shared hosting services, control panels and a great deal of software that never mentions it.[S1]
Don Smith of the Sophos Counter Threat Unit told the BBC that the flaws would likely become a priority target for hackers, and that the immediate difficulty was not installing a patch but locating and managing every place PHP runs, since it can sit beneath public sites, content management systems, hosting platforms and third-party products without the organization realizing it. He stressed the importance of watching for signs that an attacker may already have gained a foothold. Dane Knecht, chief technology officer at Cloudflare, said early attacks were emerging and mitigations were being updated as new vectors appeared.[S1]
It is not yet clear which versions of the language are affected, though CERT-EU said the problem could reach back to PHP 5, released in 2004. The PHP Foundation issued the update only for the latest versions, urging users of PHP 8.1 or older to upgrade. The NCSC advised organizations to keep monitoring for security updates from third-party vendors, including for appliances and services that may bundle PHP.[S1]
