AI Uncovers Critical PHP Flaw, Sparks Global Cyber Alert — SkimNews
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- PHP developers released emergency patches for critical vulnerabilities that allowed attackers to take control of web servers without authentication, urging all users to update immediately.
- Wiz and Calif researchers used AI to detect the flaws, which they described as among the most severe ever found, exposing millions of websites including Wikipedia and government portals.
- US National Security Agency advised organizations using PHP to take systems offline if they can't apply patches, warning the flaw provides a 'direct path' to exploit databases.
- UK National Cyber Security Centre, EU, and Australian cyber agencies issued urgent alerts urging immediate patching and checks for backdoors installed by attackers.
- Wikimedia took multiple systems offline as a precaution, while Finnish government, Edinburgh council, BBC, and Netherlands' cyber agency also suspended websites.
- OpenAI called the discovery 'one of the most impactful security issues in recent memory' and released a tool to check PHP platform security, highlighting AI's dual role in defense and attack.
Why it matters: The flaw puts millions of websites at risk of data theft, with smaller organizations most vulnerable due to limited resources. The urgency of patching—backed by global agencies—means unpatched systems face near-term exploitation, and the use of AI to find (and potentially weaponize) such flaws changes the speed and scale of cyber threats.
Ask SkimNews
