PHP flaws hidden for years force worldwide dash to secure the web

Serious flaws that lay undetected for more than a decade in the technology underpinning much of the internet have been brought to light by artificial intelligence, triggering a worldwide cyber-security alert and a rush by governments and website operators to contain the fallout.

The vulnerabilities sit within a programming language called PHP, short for PHP: Hypertext Preprocessor, which has been used internationally since the 2000s to build websites. Governments and cyber-security agencies around the world urged operators on Wednesday to install an emergency fix or consider taking their platforms offline.

Wiz, one of the security firms whose researchers uncovered the flaws, described them as the "most severe" ever detected by AI. OpenAI, whose technology was used to find them, called the discovery "one of the most impactful security issues in recent memory".

Most people may never have heard of PHP, yet they probably interact with it daily. It powers a vast range of platforms, including online shops, Wikipedia and WordPress, the content management system behind many blogs and websites. When a visitor opens a site such as Wikipedia, PHP is the code that gathers the requested information and presents it in a readable form, Paul Spain, chief executive of Gorilla Cyber Security, told the BBC.

The flaw could allow attackers to take control of affected web servers without authentication and steal sensitive data, leaving everything built on PHP exposed. Spain said AI could make such attacks easier and faster, and estimated that "millions and millions" of websites could be affected. Jill Slay, a cyber-security researcher at the University of Adelaide, said it would be "disastrous" if hackers or states weaponised the flaw and seized private data.

The alert has disrupted services globally, from gaming platforms to government portals and online forums. Wikimedia, the organisation behind Wikipedia, took down a number of its systems as a precaution. Sites and pages were taken offline by the Finnish government, Edinburgh council and the BBC, while the Netherlands' cyber-security agency pulled its own website. A number of Scotland's public organisations, including councils and health boards, also took their sites offline.

Some experts warn that poorly maintained websites, particularly those belonging to smaller organisations with limited security resources, face greater risk. More attempts to exploit the flaws are likely in the coming weeks now that the technical details are being made public, according to Salil Kanhere, a cyber-security researcher at UNSW Sydney.

Developers of the PHP platform rolled out patches on Wednesday to fix the vulnerabilities that had lurked in their software for years. "All PHP users are strongly encouraged to update immediately," the company said. Authorities and security organisations echoed the warning. The US National Security Agency told organisations using PHP to take their systems offline if they could not patch them at once, adding that the flaw could provide a "direct path" to exploit a system's database. "These risks are serious enough to require immediate patching across United States Government departments and agencies," it said.

The UK's National Cyber Security Centre gave similar advice and told organisations to check for "backdoors installed by an attacker". Its counterparts in the EU, Singapore and Australia issued comparable alerts. Japanese Prime Minister Sanae Takaichi urged people to check whether their public websites ran on PHP. "We have an urgent request for everyone to take action tonight," she wrote on X, adding that temporarily suspending websites could be an effective way to reduce risk where patching was difficult.

Tech companies are racing to secure their systems. Amazon said it had been targeted in multiple attempts days before the public disclosure of the PHP issue; it is unknown how the potential attackers knew of the vulnerability.

The flaws were found by researchers at the security firms Calif and Wiz, using advanced AI tools able to analyse code and identify weaknesses far faster than humans or older systems. "Modern software is incredibly complex, and some vulnerabilities can remain undetected for years," Kanhere said. "The underlying bugs weren't new; what changed was our ability to find them." Details of the discovery leaked online this week, forcing the platform's developers to rush out their announcement of the flaw and its scale.

The incident "highlights how AI can uncover security flaws" but also how it can "help attackers rapidly develop offensive tools and exploits," OpenAI said in a blog post. The ChatGPT-maker said it had released a program to check whether the PHP platform is secure. Ryan Ko, of the University of Queensland's Cyber Research Centre, said many of the flaws stemmed from the way software was built in the past, for functionality rather than with security in mind.

Website owners are being urged to secure their sites with the latest version of PHP; the patch is a small, routine fix for most tech teams, Spain said. The NSA called for "heightened awareness" in the coming weeks and close monitoring of updates from software vendors. "Vigilance in applying patches related to those systems is paramount," it said. The onus lies mainly on operators, but users should stay alert for security advice from affected services, such as requests to change passwords, Kanhere said. He also warned people to be wary of phishing messages exploiting the publicity around the incident.