In brief
A suite of critical security flaws in the PHP programming language was exposed by AI analysis, sparking a worldwide cyber‑security emergency. The bugs—undetected for years—enable unauthenticated attackers to seize server control and exfiltrate data, affecting high‑profile sites such as Wikipedia and the BBC. Governments from the US to Japan have ordered immediate patching and, where impossible, temporary shutdowns of vulnerable servers. The incident underscores both the power of AI to locate deep code‑bashing problems and the double‑edged nature of the same tools for attackers.
Security experts have uncovered a sweeping set of code flaws hidden in PHP—the scripting language that powers a vast swathe of the Internet—including WordPress, Wikipedia and countless ecommerce platforms.
The doors to these vulnerabilities were opened by the artificial intelligence tools of security firms Calid and Wiz, revealing bugs that could let attackers hijack servers with zero authentication and access sensitive databases. The sheer scale of the issue has forced governments worldwide to issue emergency notices: the US National Security Agency has urged all PHP‑using agencies to patch immediately or bring systems offline, while Britain’s National Cyber Security Centre warned of potential backdoors installed by attackers.
What’s at Risk?
Sites ranging from global media outlets to local government portals have been taken down as precautions. In particular, Wikipedia’s Foundation temporarily disabled several services, and the Finnish government, the Edinburgh council and the BBC have all shut down key components.
Who Elicited the Reaction?
Calid and Wiz discovered the flaws using advanced AI that analyses code faster than traditional methods. The discovery prompted an immediate rollout of patches from PHP’s development team, who urged users to install the fixes “immediately.”
Global Response
The US National Security Agency warned of a “direct path” to database compromise. The UK’s NCSC cautions that attackers may have left backdoors, for which operators should check and remove. Similar advisories flowed from the EU, Singapore and Australia. Japan’s Prime Minister Sanae Takaichi urged homeowners to verify whether their public sites run on PHP.
How AI Made It Possible
AI’s deep code‑analysis capabilities enabled researchers to uncover these long‑hidden bugs. The same technology could accelerate exploitation, a concern noted by OpenAI, whose chatbot tools were used in the discovery. The incident demonstrates the need for tighter integration of AI into defensive tooling.
What Site Owners Should Do
Update to the latest PHP release, or if patching isn’t feasible, temporarily disable sites. Monitor for any advisories or phishing attempts tied to the recent disclosure. In the U.K., the government also warns that software vendors overtake patch application for vital services.
This is a stark reminder: as software ecosystems grow more complex, AI offers both a beacon for defenders and a new weapon for attackers. Vigilance, rapid patching and user awareness will be key to minimizing damage in the days to come.
