AI uncovers critical PHP flaws, triggering global website shutdowns
Critical security vulnerabilities in the PHP programming language, underpinning roughly 70% of global websites, have forced governments and major corporations to temporarily shut down online services. Discovered by AI-assisted researchers, the flaws allow attackers to access server file systems without passwords. Security firms and national agencies urge immediate patching or offline status to prevent widespread breaches, marking one of the most significant software security events in recent years.
Key points
- Security firm Wiz and researchers using OpenAI’s technology identified two critical flaws in PHP, a programming language that powers approximately 70% of the world's websites, including Wikipedia and WordPress.
- The vulnerabilities allow attackers to gain direct access to server file systems or databases without authentication, a risk described by Wiz as potentially the most severe in software history.
- The US National Security Agency and the UK’s National Cyber Security Centre advised organizations to patch systems immediately or take them offline, noting that only sites running PHP on their own servers are directly exposed.
- Volker Dusch, a security engineer at the PHP Foundation, compared the severity of the issue to the 2014 Heartbleed bug, calling it the most serious problem PHP has faced in over a decade.
- Amazon and other major platforms experienced multiple attack attempts before the official warning embargo lifted, though many large companies remained online because they use managed hosting or other programming languages.
- The discovery highlights the growing role of artificial intelligence in uncovering long-standing software weaknesses, prompting a global rush to apply emergency fixes across public and private sectors.
A global cyber-security scramble has erupted after researchers identified two critical vulnerabilities in PHP, the programming language that underpins a significant portion of the internet. Wiz, a security firm that helped uncover the flaws, estimated that PHP powers approximately 70% of the world's websites. The vulnerabilities, which were detected using artificial intelligence models, allow attackers to access a server's file system or database without needing a password, potentially exposing sensitive data across government agencies, online stores, and news outlets.
The US National Security Agency and the UK’s National Cyber Security Centre issued urgent guidance, advising organizations to patch their systems immediately or take vulnerable platforms offline. The NCSC noted that while many large platforms use managed hosting or other languages, those running PHP on their own servers face the highest risk. Volker Dusch of the PHP Foundation compared the severity of the flaws to the 2014 Heartbleed bug, describing it as the most serious issue PHP has faced in more than a decade.
The discovery has intensified the narrative around AI’s role in software security, with OpenAI calling the event one of the most impactful security issues in recent memory. Amazon reported multiple attack attempts before the official warning was released, though it remained unclear how external actors knew about the vulnerabilities. As organizations worldwide apply emergency fixes, the incident underscores the fragility of foundational web technologies and the increasing speed at which AI can expose long-standing code weaknesses.
Sources
The WireByte editorial team synthesises technology news from multiple primary sources, verifies the facts, and links every source. Articles are produced with AI assistance and reviewed under our editorial policy.
