PHP flaws found by AI: why governments urged patching or going offline

Serious PHP flaws, hidden for over a decade and found with AI, triggered a global alert. Here is what PHP is, what broke and what site owners should do.

In 30 seconds Researchers using AI tools found serious, long-hidden flaws in PHP, the language behind a huge share of websites. The worst of them could let an attacker take over a server without logging in and steal data. PHP's developers have shipped patches; agencies like the US National Security Agency and the UK's National Cyber Security Centre say to update now, or take the site offline if you cannot.

What PHP is and why one flaw spreads so far

PHP (short for PHP: Hypertext Preprocessor) is a programming language that runs on a web server. When you open a page, PHP code gathers the data you asked for and assembles it into something your browser can display. It sits underneath online shops, Wikipedia and WordPress, the content management system behind many blogs, according to the BBC's reporting.

Image: Pixabay — who, how, what, where, why, when, ask, shelf, books, bookshelf, abstract, arrangement, accident, accident report, message, police, emergency call, declarations, description, who, how, what, why, why, why, ask, ask, shelf, bookshelf, bookshelf, bookshelf, bookshelf, bookshelf, police, description

That reach is the problem. A weakness in the language itself is inherited by everything built on it. Security firm Wiz, whose researchers helped uncover the bugs, called them the most severe ever detected by AI, and one expert quoted estimated the exposure at millions of websites.

How AI found what people missed

The flaws were found by researchers at Calif and Wiz using advanced AI tools that read code and flag weak spots far faster than people or older scanners. One academic put it plainly: the underlying bugs were not new, what changed was our ability to find them. Modern software is so complex that defects can sit unnoticed for years, and a lot of older code was written for functionality rather than security.

OpenAI, whose technology was used in the discovery, noted the double edge: the same capability can help attackers build exploits quickly. Details leaked online this week, which pushed PHP's developers to announce the problem sooner than planned. TechCrunch's coverage frames the day as a rough one for the whole internet.

What happened next

PHP's developers released patches and urged every user to update immediately. The US National Security Agency told organisations that could not patch at once to take their systems offline, warning the flaw could offer a direct path to a system's database. The UK's National Cyber Security Centre gave similar advice and added a defensive step: check for backdoors an attacker may have left behind. Agencies in the EU, Singapore and Australia issued alerts too.

The disruption was visible. Wikimedia took some systems down as a precaution, and the Finnish government, Edinburgh council, the BBC and the Dutch cyber-security agency pulled sites or pages. Amazon said it faced several attack attempts days before the public disclosure, and it is unknown how those attackers learned of the flaw. Experts expect more exploitation attempts in the coming weeks now that technical details are public, with poorly maintained sites at greatest risk.

Does this affect me? If you only browse the web, there is little to do beyond staying alert to services being briefly unavailable. If you run a website, check whether it uses PHP (many shops, blogs and WordPress installs do), apply the update PHP's developers released, and ask your host what they have done. If you cannot patch quickly, consider suspending the site, as Japan's prime minister suggested, and look for signs of tampering afterwards.

Further reading: Add as preferred on Google · BBC Shop · BritBox.

Opinion · Missing context

The headline is AI, but the lesson is older: the bugs were not new, the tools to find them were. If defenders and attackers get the same speed-up, the winner is whoever patches first, and small sites with thin budgets will be last in line.

Notice also what the material does not tell us: how attackers learned of the flaw before disclosure. Amazon reported attempts days before the announcement, and the leak forced a rushed release. Treat the 'millions of sites' estimate as an expert guess, not a measured count.

Related articles from LaRebelión

South Korea's bank breaches show AI is cutting the cost of finding holesSouth Korea warns artificial intelligence may have driven bank cyberattacksA&T Center Focuses on AI and National Defense for Security Month

• OpenAI probes more possible AI hacking incidents after the Hugging Face breach
• Wikimedia says unapproved OpenAI agents edited wikis and hammered its APIs
• Fake AI ad tools target advertisers' accounts: how to spot them

Original source: BBC

Produced with AI support and reviewed by the newsroom

Byline · Chief editor · English edition · London

“AI did not create these bugs; it shortened the time between a decade of silence and a global scramble.”