Critical PHP Flaws Force Governments to Take Websites Offline
Two critical flaws in PHP, the programming language that underpins much of the web, have forced governments, councils and broadcasters to take sites offline after a fix was rushed out. Cyber security agencies in several countries urged organisations to patch immediately, and to take systems down where they could not. According to the BBC, the fix landed after details of the vulnerability leaked.
Finland shut down its government's public web services. The Netherlands' cyber security agency took its own site offline, and the country's public health institute and the lower house of parliament became inaccessible. Edinburgh council's site went dark, as did the online homes of several BBC programmes, while the Wikimedia Foundation took systems down as a precaution and parts of Wikipedia could not be reached.
And the flaws were found by machines rather than by human review. The security firms Wiz and Calif discovered them with frontier AI models, and Wiz described them as the most severe vulnerabilities ever discovered by the technology. The pair worked through Patch the Planet, a programme run by OpenAI that gave researchers access to its advanced tools to hunt for flaws in the languages used to build websites.
The flaws had gone undetected for more than a decade. Once the models were applied the hunt took weeks, and Wiz said frontier models made the process practical by letting its researchers build and adapt working exploits across multiple applications in hours.
Wiz estimates that roughly 70% of the internet is affected, a figure the BBC could not verify. Huntress, another security firm, described PHP as everywhere, quietly running WordPress, Drupal, Joomla and Magento sites, shared hosting platforms and control panels, along with software that never advertises the dependency.
But patching is the easy part. Don Smith of the Sophos Counter Threat Unit said the real challenge is finding and managing every instance of PHP, which can sit beneath public sites, content management systems, hosting platforms and third party products without the organisation knowing. He said organisations needed to look for signs that an attacker had already gained a foothold.
The risk is severe. CERT-EU said the scores attached to the vulnerabilities indicate the potential for unauthenticated remote code execution, which could let an attacker install malware and take a site down. Dane Knecht, chief technology officer at Cloudflare, said early attacks were already appearing and mitigations were being updated as new vectors turned up.
Governments moved quickly. The US National Security Agency advised organisations to take systems offline if they could not update in time, and the White House said federal agencies were working with leading AI labs to speed a fix. The UK's National Cyber Security Centre, its counterparts in the EU and Australia, Japan's cyber security office and Japan's prime minister all urged users to act, with the prime minister asking people to check whether public sites ran on PHP.
So the disclosure arrived ahead of schedule. The PHP Foundation had planned to announce the flaw later with a complete patch, but details leaked on social media, forcing a rushed release. The update covers only the latest versions, with users on PHP 8.1 or older urged to upgrade, and CERT-EU warning the issue may reach back as far as PHP 5.
The flaws matter because PHP is invisible to the people who depend on it. It was built for web development and runs on servers, shaping what a visitor sees, and it powers a large portion of the internet without appearing on any page. OpenAI called the discovery one of the most impactful security issues in recent memory, and said an internal researcher had also found the flaw at around the same time as the outside firms.
Two critical flaws in PHP forced governments, councils and broadcasters to take sites offline.
Wiz and Calif found the flaws using frontier AI models, and Wiz called them the most severe discovered by AI.
Wiz estimates roughly 70% of the internet is affected, though the BBC could not verify that figure.
CERT-EU warns of unauthenticated remote code execution, and Cloudflare reports early attacks.
The update covers only the latest versions, and users on PHP 8.1 or older are urged to upgrade.
Source: BBC News
