PHP Vulnerabilities Spark Global Cyber Security Alert

For more than a decade, serious flaws had gone undetected in technology underpinning much of the internet. It took artificial intelligence (AI) to bring them to light, causing a global cyber-security alert. The vulnerabilities lie within a programming language called PHP, which has been used internationally since the 2000s to build websites.

Governments and cyber-security agencies around the world scrambled to contain the fallout of this discovery on Wednesday. They urged website operators to install a new emergency fix or consider taking their platforms offline. Cyber-security firm Wiz, one of the companies whose researchers uncovered the vulnerabilities, described the flaws as the "most severe" ever detected by AI. OpenAI, whose technology was used to find the flaws, called the discovery "one of the most impactful security issues in recent memory".

Most people may not have heard of PHP—short for PHP: Hypertext Preprocessor—but they interact with it daily. PHP powers a vast number of platforms, including online shops, Wikipedia, and WordPress—the content management system behind many websites like blogs. When you visit a website like Wikipedia, PHP is the code that collects information you need and presents it in a readable format.

Due to a flaw that could allow attackers to take control of affected web servers without authentication and steal sensitive data, everything built on PHP was left exposed. Paul Spain, chief executive of Gorilla Cyber Security, noted that AI could make such attacks easier and faster, estimating that the flaw could affect "millions and millions" of websites.

Jill Slay, a cyber-security researcher from the University of Adelaide, warned that it would be "disastrous" if hackers or countries weaponized the flaw and seized private data from websites. The alert has disrupted services globally, affecting everything from gaming platforms to government portals and online forums.