In brief
Artificial intelligence systems identified severe, long‑standing security problems in PHP, a core web development language. The flaw can allow attackers to hijack servers without authentication and access databases. Governments from the U.S., U.K., Japan, and Europe have instructed operators to apply urgent patches or suspend sites. Cyber‑security experts warn that the discovery also underscores how AI can accelerate both defensive and offensive cyber operations.
If you visit popular sites such as Wikipedia or use WordPress, the programming language behind them is likely PHP. A powerful AI‑based code‑analysis tool has revealed a series of defects that allow attackers to gain full control of a server without any authentication. These flaws are not new; they have existed in the code for years, but AI’s speed exposed them now.
Impact and Affected Sites
The discovery triggered widespread shutdowns of services, from local government portals to international e‑commerce sites. Major platforms such as Wikimedia, the BBC, and various local councils temporarily removed their public web pages. The University of Geneva’s website was taken offline after the flaw was reported, and similar actions followed in Finland, the Netherlands, and Singapore.
Government and Agency Response
The U.S. National Security Agency issued an emergency notice urging all federal organizations to stop operations or immediately patch PHP installations. The U.K.’s National Cyber Security Centre warned of “backdoors installed by an attacker” and advised a complete review of website security. Japan’s Prime Minister called on citizens to confirm whether their public sites use PHP and to apply patches as soon as possible; her statement on X highlighted the need to temporarily suspend websites if the fix cannot be applied promptly.
How AI Found the Weaknesses
Security researchers from several firms used AI platforms derived from OpenAI’s GPT‑model to scan PHP’s open‑source code base. The AI’s pattern‑recognition capabilities detected subtle code anomalies that traditional static‑analysis methods had previously missed. Researchers noted that the bugs themselves were old; what changed was the speed and depth at which AI can surf large code repositories.
What Operators and Users Should Do
Website owners are urged to upgrade to the latest PHP release and to test their applications for any remnants of the old vulnerabilities. National agencies have stressed careful monitoring of software suppliers and stressed the importance of applying patches promptly. Ordinary users should remain alert for phishing emails that reference the incident and be prepared to change passwords on services that might show suspicious activity.
