AI Uncovers Decade-Old PHP Flaws, Sparks Global Cyber Alert — SkimNews
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- Security researchers at Calif and Wiz used advanced AI tools to discover severe vulnerabilities in PHP that had gone undetected for over a decade, with cyber-security firm Wiz calling them the "most severe" flaws ever detected by AI and OpenAI labeling the discovery "one of the most impactful security issues in recent memory."
- PHP developers rolled out emergency patches on Wednesday, strongly urging all users to update immediately, as the flaw could allow attackers to take control of affected web servers without authentication and steal sensitive data — potentially exposing "millions and millions" of websites, per Gorilla Cyber Security CEO Paul Spain.
- The US National Security Agency directed all PHP-using organizations to take systems offline if they could not patch immediately, warning the flaw provides a "direct path" to exploit a system's database, while the UK's National Cyber Security Centre, EU, and Australian counterparts issued similar alerts.
- Wikimedia, the Finnish government, Edinburgh council, the BBC, the Netherlands' cyber-security agency, and several Scottish councils and health boards pulled websites or systems offline as a precaution in the days following the disclosure.
- Japanese Prime Minister Sanae Takaichi publicly urged people to check if their publicly available websites ran on PHP, writing on X: "We have an urgent request for everyone to take action tonight."
- OpenAI released a program to check whether PHP platforms are secure and acknowledged in a blog post that the incident shows how AI can both uncover flaws and "help attackers rapidly develop offensive tools and exploits."
Why it matters: The vulnerability sits inside code that powers a vast share of the public web — Wikipedia, WordPress, online shops — and cybersecurity researcher Salil Kanhere of UNSW Sydney warned more exploitation attempts are likely now that technical details are public. Smaller organizations with limited security resources face the greatest exposure, since the US NSA and UK's NCSC have effectively told them to go dark if they cannot patch in time.
Ask SkimNews
