In brief
Security researchers using advanced AI tools identified long‑hidden vulnerabilities in the PHP programming language, the backbone of many websites worldwide. The flaw could let attackers take full control of web servers without authentication, and the public disclosure has triggered governments, security agencies and service providers to urgently apply patches or take sites offline. The incident highlights both the power of AI to find bugs and the risks it poses by rapidly enabling malicious exploitation.
For more than a decade, deep security gaps in the software that powers the internet have gone unnoticed. Now, artificial intelligence has exposed a series of critical bugs in PHP – the popular scripting language behind sites like Wikipedia, WordPress and countless online shops.
The flaws, found by researchers at the security firms Wiz and Calif, can let attackers seize control of an affected web server without any authentication and launch data‑theft or defacement attacks. According to the firms, up to millions of sites could be vulnerable.
Governments and cyber‑security agencies around the world are demanding that operators immediately install the emergency patch issued by the PHP project, or temporarily shut down their services. The United States National Security Agency has advised all organisations that run PHP to go offline if they cannot patch instantly, warning of a "direct path" to database compromise.
What is the flaw?
PHP, short for Hypertext Preprocessor, is the backbone of many websites. It generates dynamic content by pulling information from databases and displaying it on the page. The newly discovered flaw removes the need for user authentication to gain server control, essentially giving attackers full power over the site.
Experts warn that this could be exploited to steal sensitive data or weaponise the infrastructure against rivals or state‑sponsored actors. The rapidity with which AI can locate such vulnerabilities means that attackers could also develop exploits quickly.
What websites have been affected?
Global systems have been forced offline or placed on standby, including the Wikimedia Foundation, the BBC, the Finnish government, Edinburgh council and the University of Geneva. Gaming platforms and other online portals have also taken precautionary measures.
What happened after the flaws were exposed?
The PHP core team rolled out a patch earlier on Wednesday. Authorities worldwide issued urgent advisories urging immediate update of PHP to the latest version. The NSA, UK National Cyber Security Centre, and counterparts in the EU, Singapore and Australia all echoed the call for swift action.
How is AI finding weak spots?
Advanced AI models can analyze millions of lines of code quickly, spotting patterns that may indicate bugs. In this case, researchers used such tools to scan PHP’s long‑standing codebase and reveal the hidden vulnerability. The incident underscores both the benefits and dangers of AI‑driven security research.
What can people do to safeguard themselves?
Website owners should apply the PHP update immediately and verify that no unauthorized backdoors remain. The NSA recommends heightened vigilance over the coming weeks and monitoring of any service‑specific security notices. Users should stay alert to phishing attempts that exploit the publicity around the incident and change passwords on services that may have been affected.
