Critical PHP flaws found by AI push websites worldwide offline
Two severe holes in PHP, the language behind most websites, were patched on Wednesday. Agencies told anyone unable to update to take their sites down.
Governments and cyber-security agencies around the world urged website owners on Wednesday to fix two critical vulnerabilities in PHP, the server-side programming language that powers roughly 70% of the websites on the internet, including sites built on WordPress. The PHP Foundation released patches the same afternoon.
The warnings were unusually blunt. The US National Security Agency said that organisations unable to apply the fix should take their systems offline, because the flaws can give attackers a direct path into a server's file system or database. Finland temporarily shut down the government's public web services, the Netherlands' cyber-security agency took its own site offline, and the Wikimedia Foundation pulled several systems as a precaution, leaving parts of Wikipedia unavailable for some users. Edinburgh council's website and the art platform DeviantArt also went down.
The holes have existed in every version of PHP since version 5, released in 2004. Site owners are advised to move to the current release, PHP 8.5.12; versions 8.1 and older no longer receive support, so many sites face extra upgrade work.
Both flaws were found with artificial intelligence. A security firm taking part in OpenAI's "Patch the Planet" programme found one using an OpenAI model, while Google-owned Wiz used its own AI agent together with Google and OpenAI models and described the bugs as the most severe vulnerabilities ever discovered by AI. Both teams worked with PHP's maintainers on fixes before going public, and the White House said federal agencies were working with leading AI labs to speed up remediation.