In brief
An AI‑based scan exposed hidden flaws in PHP, a core language that powers WordPress, Wikipedia and millions of other sites. The discovery triggered a worldwide cyber‑security alert, forcing governments and businesses to shut down or patch affected servers. Security firms Calf and Wiz used OpenAI‑powered models to mine the code, revealing that attackers could hijack servers without authentication. Global agencies warned of the risk of data theft and urged immediate updates, while users faced potential phishing threats.
What is PHP and why did it spark a global cyber‑security scramble?
For more than a decade, critical flaws in the foundational code for the web have gone unnoticed. Now, artificial‑intelligence tools have exposed them, sending a shockwave through international cyber‑security circles.
The secret lies in PHP—Hypertext Preprocessor—a programming language first published in 2000 and still powering a large portion of internet content from WordPress blogs to Wikipedia. The newly discovered bugs allow attackers to hijack a web server without logging in and exfiltrate data.
What sites were hit?
From gaming networks to municipal sites, the alert forced a global response. Wikipedia’s Wikimedia Foundation pulled several services, the Finnish government shut down public portals, and the BBC switched local sites offline. Even the University of Geneva’s website was taken offline at the request of European Computer Emergency Response Team.
The AI advantage
Security firms Calf and Wiz leveraged machine‑learning code‑analysis models built on OpenAI’s technology to sift through millions of lines of PHP code. The models flag trends that human auditors would miss, accelerating the discovery of latent flaws that have sat in the codebase for years.
What to do now
PHP developers have released an emergency patch. Site owners are urged to upgrade to the latest release immediately, or temporarily suspend services until updates can be applied. National agencies in the US, UK, EU, Singapore and Australia have issued official advisories recommending patching or shutdown.
For everyday users, stay alert for phishing emails referencing the scare and keep passwords fresh on affected services.
