AI Discovery Reveals Severe Vulnerabilities in Widely Used PHP Programming Language

A programming language powering an estimated 70 percent of the world’s websites, PHP, has been found to contain critical security flaws, prompting a global cyber-security alert. The vulnerabilities, described as “the most severe” ever detected by AI, were uncovered using technology from OpenAI and researchers at Wiz. The flaws could allow attackers to take control of affected web servers and steal sensitive data, impacting sites ranging from Wikipedia and WordPress to government portals and gaming platforms. Developers have released an emergency fix, but experts warn that poorly maintained websites are at greater risk and exploitation attempts are likely to increase as technical details become public.

For more than a decade, these flaws went undetected in PHP, short for PHP: Hypertext Preprocessor, which has been used internationally since the 2000s to build websites. When a user visits a site like Wikipedia, PHP collects and presents the information in a readable format. The discovery prompted Wikimedia, the organization behind Wikipedia, to take down systems as a precaution. The Finnish government, Edinburgh council, the BBC, and the Netherlands’ cyber-security agency also took their websites offline. Paul Spain, chief executive of Gorilla Cyber Security, estimates that “millions and millions” of websites are affected.

Wiz researchers and OpenAI identified the vulnerabilities on Wednesday, triggering a scramble among governments and cyber-security agencies to contain the fallout. Cyber-security researcher Jill Slay from the University of Adelaide warned that weaponizing the flaw and seizing private data would be “disastrous.” Salil Kanhere from UNSW Sydney anticipates more exploitation attempts in the coming weeks as the technical details are released. Developers of the PHP platform released a fix on Wednesday, urging website operators to install it or consider taking their platforms offline. The potential for AI to accelerate attacks is a concern, according to Spain, and the flaws represent “one of the most impactful security issues in recent memory,” according to OpenAI.

Where they differ

• France24 emphasized the role of AI in discovering the vulnerabilities, framing it as a key aspect of the story.
• BBC US focused on the scale of potential impact, citing estimates of ‘millions and millions’ of affected websites.
• France24 stated PHP powers roughly 70 percent of the world’s websites, a statistic not explicitly stated in the BBC US report.

What is not yet known

• The full extent of websites that have been compromised remains unknown.
• The specific mechanisms by which attackers could exploit the flaws beyond general descriptions are not detailed.

Was this useful? 👍 0 👎 0

---

Read the original coverage