Serious vulnerabilities in the PHP programming language, which underpins a large portion of the internet, went undetected for over a decade before being discovered by artificial intelligence, triggering a global cybersecurity alert. Governments and cybersecurity agencies worldwide urgently mobilised on Wednesday to contain the consequences of the discovery.
PHP has been used internationally since the 2000s for building websites and powers numerous platforms, including online stores, Wikipedia and WordPress, the content management system behind many blogs and other sites. The vulnerability could allow attackers to take control of affected web servers without authentication and steal sensitive data. Paul Spain, chief executive of Gorilla Cyber Security, told the BBC that PHP collects information required by the visitor and displays it in a readable manner. He estimated that the vulnerability could affect millions and millions of websites.
Agencies have urged website operators to install a new emergency patch or consider taking their platforms offline. The US National Security Agency (NSA) told all organisations using PHP to take their systems offline if they could not patch them immediately, adding that the vulnerability could provide a 'direct path' to exploiting the system's database. 'These risks are serious enough to require immediate patching in US government departments and agencies,' the NSA said. The UK's National Cyber Security Centre issued similar advice, telling organisations to check for 'backdoors installed by an attacker', while its counterparts in the EU and Australia also issued similar warnings.
The alert disrupted services globally, from gaming platforms to government portals and online forums. Wikimedia, the organisation behind Wikipedia, removed a number of its systems as a precaution. The Finnish government, the Edinburgh council and the BBC took their websites offline, and the Dutch cybersecurity agency also pulled its website. A number of Scottish public organisations, including councils and health boards, took their websites offline. Japanese Prime Minister Sanae Takaichi urged people to check whether their publicly accessible websites run on PHP. 'We have an urgent request for everyone to take action tonight,' Takaichi wrote on X, adding: 'If it is difficult to apply a patch immediately, temporarily suspending websites and similar measures can be considered an effective way to reduce risk.'
PHP platform developers released patches on Wednesday to fix the vulnerabilities that had lurked in their software for years. 'All PHP users are strongly encouraged to update immediately,' the platform said. The vulnerabilities were discovered by researchers at security firms Calif and Wiz, using advanced AI tools that can analyse code and find errors much faster than humans or older systems. Cybersecurity firm Wiz described the vulnerabilities as the 'hardest' ever discovered using AI, while OpenAI called the discovery 'one of the most significant security issues in recent memory'. OpenAI said in a blog post that the incident 'highlights how AI can discover security flaws', but also how it can 'help attackers quickly develop offensive tools and exploits', and published a programme to check whether the PHP platform is secure.
Experts warn that the vulnerability could leave poorly maintained websites, particularly those of smaller organisations with limited security resources, at greater risk. Salil Kanhere of UNSW Sydney said that further attempts to exploit these vulnerabilities are likely in the coming weeks as technical details become public. 'Modern software is incredibly complex, and some vulnerabilities can remain undetected for years,' Kanhere said, adding: 'The basic errors were not new; what has changed is our ability to find them.' Jill Slay, a cybersecurity researcher at the University of Adelaide, said it would be 'catastrophic' if hackers or states exploited the vulnerability and took private data. Ryan Ko of the University of Queensland's Cyber Security Research Centre said: 'Many of these errors stem from the way the software was built in the past, which was built for functionality, not with security in mind.'
Details of the discovery leaked online this week, forcing PHP platform developers to accelerate the publication of the security flaw and its enormous scale. Website owners are urged to secure their sites with the latest version of PHP. The NSA called for 'heightened awareness' in the coming weeks and close monitoring of software vendor updates. 'Vigilance in applying patches related to these systems is paramount,' the NSA said. Kanhere said that responsibility largely lies with website operators, but users should remain alert for security advice from affected services, such as requests to change passwords.
