AI discovery of PHP flaws triggers global cyber-security response

Governments and cyber-security agencies around the world have urged website operators to patch vulnerabilities in PHP, a programming language used to build websites since the 2000s. Researchers say the flaws had gone undetected for years.

Security firms Calif and Wiz found the vulnerabilities using AI tools that analyse code. Wiz described them as the “most severe” flaws ever detected by AI. OpenAI called the discovery “one of the most impactful security issues in recent memory”.

The flaws could allow attackers to take control of affected web servers without authentication and steal sensitive data. Paul Spain, chief executive of Gorilla Cyber Security, told the BBC the vulnerability could affect “millions and millions” of websites. PHP powers platforms including Wikipedia, online shops and WordPress.

The alert disrupted services globally. Wikimedia took some systems offline as a precaution, while websites or pages were also taken offline by the Finnish government, Edinburgh council, the BBC, the Netherlands’ cyber-security agency and the University of Geneva. Some Scottish councils and health boards did the same.

PHP developers released patches on Wednesday and urged users to update immediately. The US National Security Agency advised organisations that cannot patch at once to take their systems offline. Japan’s Prime Minister Sanae Takaichi also urged people to check whether public websites run on PHP.

Researchers warn that attempts to exploit the flaws may increase as technical details become public. OpenAI said AI can help uncover vulnerabilities, but may also help attackers develop exploits faster.