AI Reveals Critical PHP Flaw, Urging Immediate Action

A critical security flaw in PHP, the programming language powering millions of websites, has triggered a global cyber-security alert ^[1]. Discovered by AI tools used by researchers at Wiz and Calif, the vulnerability could allow attackers to take control of web servers without authentication, potentially exposing sensitive data.

The flaw, which has gone undetected for over a decade, affects platforms including Wikipedia, WordPress, online shops, and government portals ^[1]. In response, Wikimedia took down several systems, while the BBC, Finnish government, Edinburgh council, and the Netherlands’ cyber-security agency temporarily shut down websites.

Cyber-security experts warn the risk is severe: OpenAI called it "one of the most impactful security issues in recent memory," while the US National Security Agency urged immediate patching or system shutdowns for unpatched PHP systems ^[1]. The UK’s National Cyber Security Centre and EU and Australian counterparts issued similar warnings, advising organisations to check for backdoors.

Japan’s Prime Minister Sanae Takaichi urged all public websites using PHP to act immediately, suggesting temporary suspension if patching isn’t possible ^[1]. The PHP development team released emergency patches, urging all users to update immediately.

Experts note that while the underlying bugs aren’t new, AI’s ability to rapidly analyse complex code has revealed them for the first time ^[1]. The same tools that uncover flaws can also be weaponised by attackers, raising concerns about future exploits.

Users are advised to watch for phishing attempts exploiting the incident and to follow security updates from affected services ^[1]. The US NSA has called for heightened awareness and continuous monitoring of vendor updates.