What emerged
For over ten years, serious flaws remained undetected in the technology underpinning much of the internet. According to the BBC's account, artificial intelligence brought them to light, triggering a global cybersecurity alert. The vulnerabilities involve PHP, the programming language used internationally since the 2000s to build websites.
On Wednesday, governments and security agencies around the world moved to contain the consequences of the discovery, urging site operators to install a new emergency fix or consider suspending platforms. The security firm Wiz, among those whose researchers identified the flaws, called them the most serious ever detected by AI. OpenAI, whose technology was used to find them, described it as one of the most impactful security problems in recent memory.
Why it matters
PHP is little known to the public but is encountered every day: it powers a large number of platforms, including online stores, Wikipedia and WordPress, the content management system behind many sites such as blogs. Paul Spain, CEO of Gorilla Cyber Security, told the BBC that when one visits a site like Wikipedia, it is PHP code that gathers the necessary information and presents it in a readable form on the web.
The flaw potentially allows attackers to take control of affected web servers without authentication and to steal sensitive data, leaving everything built on PHP exposed. Spain estimates that the problem could affect millions and millions of sites. Researcher Jill Slay of the University of Adelaide warned that it would be disastrous if hackers or states turned the flaw into a weapon to seize private data.
Services suspended and guidance from authorities
The alert disrupted services worldwide, from gaming platforms to government portals and online forums. Wikimedia, the organization behind Wikipedia, shut down several systems as a precaution. Sites and pages were taken offline by the Finnish government, Edinburgh Council and the BBC, while the Dutch cybersecurity agency took down its own site. Numerous Scottish public organizations, including councils and health boards, did the same.
PHP developers distributed the fixes on Wednesday, urging all users to update immediately. The U.S. National Security Agency asked organizations to take systems offline if they cannot apply the patch immediately. The UK National Cyber Security Centre and agencies in the EU, Singapore and Australia also issued similar advisories. Japanese Prime Minister Sanae Takaichi urged checking whether public websites use PHP.
How they were found
The vulnerabilities were identified by researchers at security firms Calif and Wiz, using advanced AI tools capable of analyzing code and finding flaws much faster than humans or previous systems. Researcher Salil Kanhere of UNSW Sydney noted that the underlying bugs were not new: what had changed was the ability to find them. Details of the discovery leaked online this week, prompting PHP developers to bring forward the announcement.
Amazon said it had been the target of multiple attempts days before the problem was publicly disclosed; it is not known how potential attackers were aware of it. OpenAI published a program to check whether PHP is secure. The actual scale of the attacks suffered and how many platforms have already been updated remain to be verified.
