A global cyber-security alert has been triggered after artificial intelligence tools uncovered severe programming flaws in PHP, a foundational technology behind much of the internet. The long-hidden vulnerabilities affect the widely used coding language that has powered online platforms, including Wikipedia, e-commerce stores, and WordPress sites, since the 2000s.
Security researchers at the firms Wiz and Calif discovered the flaws using advanced AI software provided by OpenAI. According to experts, the programming errors had lurked in the system for years without detection. Cyber-security firm Wiz described the flaws as the most severe ever found using AI, while OpenAI characterized the finding as one of the most significant security issues in recent history.
Risks to Unprotected Web Servers
The newly identified vulnerabilities could allow unauthenticated cyber attackers to seize control of web servers and access private information. Paul Spain, chief executive of Gorilla Cyber Security, explained that PHP processes requested web information and presents it to readers, adding that millions of websites could be exposed. Security researchers warned that AI tools could also enable attackers to develop automated exploit tools quickly, particularly targeting poorly maintained websites with limited resources.
Details regarding the security issue leaked online, prompting the developers of the PHP platform to publish emergency patches. The platform’s developers strongly urged all users to update their software immediately to mitigate potential risks.
Global Operations and Public Websites Taken Offline
In response to the discovery, international governments and national cyber-security authorities advised organizations to install updates or temporarily shut down vulnerable platforms. The US National Security Agency advised agencies to take systems offline if immediate patching was not possible, citing direct threats to databases. Similar security alerts were issued by agencies in the United Kingdom, the European Union, Singapore, Australia, and Japan. Japanese Prime Minister Sanae Takaichi publicly requested that site operators inspect their systems and temporarily disable public websites if updates could not be quickly applied.
Numerous public and private entities temporarily took systems offline as a protective measure. Affected organizations include Wikimedia, the Finnish government, Edinburgh council, the BBC, the Netherlands’ cyber-security agency, and multiple public health boards and local councils across Scotland. E-commerce leader Amazon reported experiencing multiple unauthorized access attempts prior to the public announcement, though the source of those attempts remains unknown.
Security analysts recommend that website administrators install the latest software updates promptly. Users have also been advised to remain alert for official notifications regarding security updates, potential password resets, or phishing attempts seeking to capitalize on the incident.
Source: BBC News
