Serious security flaws in PHP, a programming language used to build millions of websites, have triggered a global cybersecurity alert after researchers used artificial intelligence (AI) tools to identify vulnerabilities that had remained undetected for years.
Governments, cybersecurity agencies and technology companies are urging website operators to install emergency software updates or temporarily take vulnerable platforms offline to prevent potential attacks.
Cybersecurity firm Wiz, whose researchers helped uncover the flaws, described them as the most severe vulnerabilities identified by AI. OpenAI, whose technology was used in the research, called the discovery one of the most significant cybersecurity issues in recent years.
PHP, short for PHP: Hypertext Preprocessor, is widely used to develop websites and online services, including Wikipedia, online shopping platforms and websites built with WordPress.
The programming language processes information and delivers it to users through websites. However, the newly discovered vulnerabilities could allow attackers to take control of affected servers without authentication and access sensitive information.
Paul Spain, chief executive of Gorilla Cyber Security, warned that the flaws could affect millions of websites. Cybersecurity researcher Jill Slay of the University of Adelaide said the misuse of the vulnerabilities could expose private data on a large scale.
Websites taken offline
The security alert has disrupted online services worldwide, affecting government portals, public institutions, gaming platforms and online forums.
Wikimedia, the organisation behind Wikipedia, temporarily shut down some systems as a precaution. Several public websites in Finland, the Netherlands and Scotland were also taken offline, along with sites operated by Edinburgh Council and the University of Geneva.
Experts warned that smaller organisations with limited cybersecurity resources could face greater risks, particularly if their websites are not regularly maintained.
Salil Kanhere, a cybersecurity researcher at UNSW Sydney, said attempts to exploit the flaws could increase in the coming weeks as technical details become publicly available.
Governments urge immediate action
PHP developers released security updates on Wednesday and urged users to install them immediately.
The US National Security Agency advised organisations to temporarily take affected systems offline if they could not apply the updates promptly. It warned that the vulnerabilities could provide attackers with a direct route to databases.
The UK's National Cyber Security Centre issued similar advice, urging organisations to check their systems for unauthorised access and hidden backdoors.
Cybersecurity authorities in the European Union, Singapore and Australia also issued warnings.
Japanese Prime Minister Sanae Takaichi urged operators of publicly accessible websites to check whether their systems used PHP and apply the necessary fixes.
Amazon, meanwhile, said it had faced multiple attempts to target its systems days before the vulnerabilities were publicly disclosed. It remains unclear how the potential attackers learned about the flaws.
How AI helped uncover the flaws
Researchers at cybersecurity firms Calif and Wiz used advanced AI tools to examine software code and identify weaknesses more quickly than traditional methods.
Kanhere said complex software could contain security problems that remain unnoticed for years. The underlying flaws were not new, but advances in AI made them easier to detect, he said.
OpenAI said the incident demonstrated AI's potential to identify security weaknesses while also highlighting the risk that attackers could use the technology to develop malicious tools and exploit vulnerabilities.
The company said it had released a programme to help check whether PHP systems were secure.
Ryan Ko of the University of Queensland's Cyber Research Centre said many vulnerabilities originated in older software designed primarily to provide functionality rather than strong security protections.
How website operators and users can stay safe
Website owners are being advised to install the latest security updates for PHP and closely monitor announcements from software providers.
Paul Spain said applying the patch should be a routine task for most technical teams.
The US National Security Agency also urged organisations to remain alert and promptly apply relevant security updates.
Although website operators are primarily responsible for securing their platforms, users should follow security advice from affected services, including requests to change passwords when necessary, Kanhere said.
He also warned users to watch out for phishing messages that exploit the incident to trick people into revealing passwords or other sensitive information.
Source: Al Jazeera