A major cybersecurity alert has been issued after researchers discovered severe vulnerabilities in PHP, the programming language that powers a significant portion of the internet, including platforms such as Wikipedia, WordPress and countless online stores.
The flaws, which reportedly remained hidden for more than a decade, were uncovered with the help of advanced artificial intelligence tools. Security researchers say the vulnerabilities could allow attackers to gain control of affected web servers without authentication and access sensitive data.
Cybersecurity company Wiz, whose researchers helped identify the issue, described it as the most serious vulnerability ever discovered using AI. OpenAI, whose technology assisted in the discovery, said it ranks among the most significant cybersecurity issues identified in recent years.
What is PHP?
PHP, short for PHP: Hypertext Preprocessor, is a programming language widely used to build and operate websites.
When users access sites such as Wikipedia, PHP is responsible for retrieving information from databases and displaying it in a readable web format. Because PHP underpins millions of websites globally, vulnerabilities within the language have the potential to affect a vast number of online services.
Experts estimate that millions of websites could be exposed if the flaw is not addressed.
Disruptions around the world
The discovery prompted precautionary measures by organisations across several countries.
Wikimedia, which operates Wikipedia, temporarily shut down some systems as a safety measure.
Websites belonging to government bodies, local authorities and public organisations in countries including Finland, the Netherlands and the United Kingdom were also taken offline. Several Scottish councils and health boards reportedly suspended online services while assessing any potential risks.
Cybersecurity specialists have warned that smaller organisations with limited security resources may be particularly vulnerable.
Emergency fixes released
PHP developers have issued security patches designed to close the vulnerabilities and urged all users to update immediately.
Government agencies around the world echoed the warning.
The US National Security Agency (NSA) advised organisations unable to apply the updates immediately to consider taking affected systems offline, warning that attackers could use the flaw to gain direct access to databases.
The UK National Cyber Security Centre, along with authorities across the European Union, Australia and Japan, also issued alerts urging organisations to update their systems and check for signs of compromise.
Japanese Prime Minister Sanae Takaichi publicly urged organisations to determine whether their websites rely on PHP and to install fixes without delay.
How AI found the flaws
Researchers from cybersecurity firms Calif and Wiz used advanced AI tools capable of analysing large volumes of software code and identifying weaknesses far more quickly than traditional methods.
Experts say the vulnerabilities themselves were not new. Instead, what changed was the ability to find them.
The discovery highlights the growing role of artificial intelligence in cybersecurity, both as a defensive tool capable of identifying hidden vulnerabilities and as a technology that could potentially help attackers develop exploits more rapidly once flaws become public.
What website owners and users should do
Website operators are being urged to update to the latest version of PHP as quickly as possible and closely monitor guidance from software vendors and cybersecurity authorities.
For ordinary internet users, experts recommend remaining alert for security notifications from online services, including requests to change passwords or secure accounts.
They have also warned that cybercriminals may attempt to exploit public concern about the incident through phishing emails and fraudulent messages claiming to offer security fixes.
Source: BBC
