In brief
Artificial‑intelligence tools exposed a series of long‑standing PHP vulnerabilities that threaten billions of websites. Governments, businesses and security agencies rushed to patch the software or temporarily take sites offline. Experts explain the scope, AI’s role, and how web operators can protect themselves amid a worldwide scramble.
For over a decade, critical security issues lay dormant in a language used by billions of websites. An AI‑powered code review finally uncovered them, sparking a global cybersecurity emergency.
The hidden flaws exist in PHP – the programming language behind popular platforms such as WordPress, Wikipedia and countless e‑commerce sites. A patch was released Wednesday, but the damage had already spread.
Governments, cyber‑security agencies and website owners around the world reacted swiftly. The U.S. National Security Agency advised government departments to shut any PHP‑based sites that couldn’t be updated immediately. The UK’s National Cyber Security Centre warned of potential backdoors and urged rapid patching. In other nations, ministries and city councils removed websites to prevent exploitation.
Security researchers at Wiz and Calif identified the bugs using advanced AI that scans code far faster than human teams. OpenAI, which supplied the technology, called the discovery “one of the most impactful security issues in recent memory.”
The scale of the threat is immense. "Millions of websites run on PHP," said Paul Spain, CEO of Gorilla Cyber Security. If attackers gain control of a server, they could steal data, install backdoors or launch further attacks. Jill Slay of the University of Adelaide warned of weaponised use by nation‑states.
Affected services include major news outlets, government portals, educational institutions, and gaming platforms. The University of Geneva’s website, Edinburgh council’s site, and the BBC have all gone offline for precautionary reasons.
In the coming weeks, attackers may try to exploit the publicly released technical details. “We need to stay vigilant,” said UNSW researcher Salil Kanhere. He urged website operators to apply the latest PHP release immediately and for users to watch for phishing attempts that exploit the incident.
Japan’s Prime Minister Sanae Takaichi urged the public to check their public sites and consider temporary shutdowns if patching is delayed. Amazon, a major target, reported multiple intrusion attempts days before the disclosure.
The incident showcases how AI can both detect deep‑rooted flaws and accelerate the development of exploit tools. Secure coding practices, timely updates, and continuous monitoring are now more critical than ever.
