OMM Newsroom
Serious vulnerabilities in PHP, a programming language used to build websites around the world since the 2000s, went undetected for more than a decade before researchers identified them using artificial intelligence (AI), according to BBC World.
Governments and cyber-security agencies issued alerts on Wednesday, urging website operators to install emergency fixes or consider taking their platforms offline. Cyber-security firm “Wiz”, whose researchers helped uncover the flaws, called them the “most severe” vulnerabilities ever detected by AI. “OpenAI” described the discovery as one of the most impactful security issues in recent memory.
PHP vulnerabilities put websites at risk
PHP stands for PHP: Hypertext Preprocessor. It is used by a wide range of services, including online shops, “Wikipedia” and “WordPress”, a content management system used by many websites.
Paul Spain, chief executive of “Gorilla Cyber Security”, told the BBC that PHP collects information needed by a website and presents it in a format people can read. The flaw could allow attackers to take control of affected web servers without authentication and steal sensitive data.
Spain estimated that the vulnerability could affect “millions and millions” of websites, and said AI could make attacks easier and faster. Cyber-security researcher Jill Slay of the University of Adelaide warned it would be “disastrous” if hackers or countries used the flaw to seize private data.
The alert disrupted services around the world, including gaming platforms, government portals and online forums. “Wikimedia”, the organisation behind “Wikipedia”, took some of its systems offline as a precaution. The Finnish government, Edinburgh council and the BBC also took websites or pages offline, while the Netherlands’ cyber-security agency pulled its website.
Several public organisations in Scotland, including councils and health boards, also took their websites offline. Experts warned that poorly maintained sites, especially those run by smaller organisations with limited security resources, could be at greater risk.
Salil Kanhere, a cyber-security researcher at UNSW Sydney, said further attempts to exploit the vulnerabilities were likely in the coming weeks as technical details became public.
Emergency patches and advice for website operators
PHP’s developers released patches on Wednesday to address vulnerabilities that had been present in the software for years, urging users to update immediately. Security authorities around the world echoed the call for operators to secure their platforms.
The US National Security Agency advised organisations using PHP to take their systems offline if they could not install a patch immediately. It said the flaw could provide a “direct path” to a system’s database and that the risks required immediate patching across US government departments and agencies.
The UK’s National Cyber Security Centre issued similar advice and told organisations to check for “backdoors installed by an attacker”. Its counterparts in the European Union and Australia also issued alerts.
Japanese Prime Minister Sanae Takaichi urged people to check whether their publicly accessible websites used PHP. In a post on “X”, she called for urgent action and said temporarily suspending websites could reduce risk if the patch could not be applied promptly.
The vulnerabilities were found by researchers at security firms “Calif” and “Wiz”, who used AI tools to analyse code and identify flaws faster than people or older systems. Kanhere said the underlying bugs were not new; the ability to find them had changed.
Details of the discovery leaked online during the week, prompting PHP’s developers to announce the security issue and its scale sooner. “OpenAI” said the incident showed that AI can uncover security flaws but can also help attackers develop offensive tools and exploits quickly. The company said it had released a program to check whether PHP was secure.
Ryan Ko of the University of Queensland’s Cyber Research Centre said many of the flaws stemmed from software built in the past with functionality, rather than security, in mind.
Website owners have been urged to install the latest version of PHP. The US National Security Agency called for heightened awareness in the coming weeks and close monitoring of software vendor updates, saying prompt patching was essential.
Kanhere said responsibility lay mainly with website operators, but advised users to watch for security guidance from affected services, including requests to change passwords. He also warned people to be alert to phishing messages exploiting publicity around the incident.
