Researchers have uncovered severe vulnerabilities in the PHP programming language that had gone undetected for more than a decade. This was reported by Qazaqyia.kz citing BBC News.
Artificial intelligence (AI) was used to bring the flaws to light, causing a global cyber-security alert. PHP has been used internationally since the 2000s to build websites.
On Wednesday, governments and cyber-security agencies around the world scrambled to contain the fallout of the discovery. They urged website operators to install a new emergency fix or consider taking their platforms offline.
Cyber-security firm Wiz, one of the companies whose researchers uncovered the vulnerabilities, described the flaws as the "most severe" ever detected by AI. OpenAI, whose technology was used to find the flaws, called the discovery "one of the most impactful security issues in recent memory."
PHP — short for PHP: Hypertext Preprocessor — powers a vast number of platforms, including online shops, Wikipedia and WordPress, the content management system behind many websites like blogs. Most people may not have heard of PHP, but they certainly interact with it daily.
Paul Spain, chief executive of Gorilla Cyber Security, told the BBC that when you visit a website like Wikipedia, PHP is the code that collects the information you need and presents it in a way you can read on the web. But due to a flaw that could allow attackers to take control of affected web servers without authentication and steal sensitive data, everything built on PHP was left exposed.
AI could make such attacks easier and faster, Spain said, estimating that the flaw could affect "millions and millions" of websites. It would be "disastrous" if hackers or countries weaponised the flaw and seized private data from websites, said cyber-security researcher Jill Slay from the University of Adelaide.
The alert has disrupted services globally, from gaming platforms to government portals and online forums. That includes Wikimedia — the organisation behind the online encyclopaedia Wikipedia — which took down a number of its systems as a precautionary measure. Sites and pages have been taken offline by the Finnish government, Edinburgh council and the BBC, with the Netherlands' cyber-security agency also pulling its website. A number of Scotland's public organisations, including councils and health boards, have also taken their websites offline.
Some experts warn the vulnerability could leave poorly maintained websites, particularly those belonging to smaller organisations with limited security resources, at greater risk. More attempts to exploit these flaws are likely in the coming weeks since the technical details are now being made public, cyber-security researcher Salil Kanhere from UNSW Sydney said.
Developers of the PHP platform on Wednesday rolled out patches to fix the vulnerabilities that had been lurking in their software for years. "All PHP users are strongly encouraged to update immediately," the company said. Authorities and security organisations around the world have echoed those warnings to website operators to secure their platforms.
The US National Security Agency told all organisations that use PHP to take their systems offline if they were unable to patch them immediately, adding that the flaw could provide a "direct path" to exploit a system's database. "These risks are serious enough to require immediate patching across United States Government departments and agencies," the agency said.
The UK's National Cyber Security Centre gave similar advice and told organisations to check for "backdoors installed by an attacker." Its counterparts in the EU and Australia have also issued similar alerts.
Japanese Prime Minister Sanae Takaichi urged people to check if their publicly available websites ran on PHP. "We have an urgent request for everyone to take action tonight," Takaichi wrote on X. "If it is difficult to apply the fix patch promptly, temporarily suspending websites and similar measures can be considered an effective way to reduce risk," she said.