AI Finds Decade-Old PHP Flaws, Triggering Global Alert

By Amara Osei

A global cybersecurity alert on Wednesday followed the AI-assisted discovery of PHP flaws that had gone undetected for more than a decade, according to Calif and Wiz.

Governments and agencies across the US, UK, EU, Australia and Japan told website operators to patch immediately or take sites offline.

What did researchers uncover?

Wiz, one of the firms whose researchers found the flaws, described them as the “most severe” ever detected by AI.

OpenAI, whose technology the researchers used, called the discovery “one of the most impactful security issues in recent memory.”

Why does PHP matter?

PHP—short for PHP: Hypertext Preprocessor—has been used internationally since the 2000s to build websites and underpins much of the internet.

It powers a vast number of platforms, including online shops, Wikipedia and WordPress, the content management system behind many blogs, the report said.

Most people interact with PHP daily, even when they do not know the language is running the site.

Gorilla Cyber Security CEO Paul Spain told the BBC that PHP collects information and presents it in a readable form when someone visits a site such as Wikipedia.

The flaw disclosed by Calif and Wiz could allow attackers to control affected web servers without authentication and steal sensitive data.

The report said the resulting exposure affected everything built on PHP.

Spain said AI could make such attacks easier and faster. He estimated the flaw could affect “millions and millions” of websites.

University of Adelaide cybersecurity researcher Jill Slay said it would be “disastrous” if hackers or countries weaponized the flaw and seized private data from websites.

Why did organizations take sites offline?

The response reached gaming platforms, government portals and online forums worldwide, according to the report.

• Wikimedia, the organization behind Wikipedia, took down a number of systems as a precaution.
• The Finnish government, Edinburgh council and the BBC took sites or pages offline. The Netherlands’ cybersecurity agency also pulled its website.
• A number of Scottish public organizations, including councils and health boards, also took their websites offline.

The report said poorly maintained websites, especially those run by smaller organizations with limited security resources, faced greater risk.

What changed after disclosure?

Technical details leaked online this week, forcing PHP developers to rush out their announcement of the security flaw and its huge scale.

On Wednesday, PHP developers released patches for bugs that had remained in the software for years.

PHP developers said: “All PHP users are strongly encouraged to update immediately.”

Authorities and security organizations worldwide echoed that warning to website operators.

The US National Security Agency told every organization using PHP to take its systems offline if it could not patch immediately.

It said the flaw could provide a “direct path” to exploit a system’s database.

The agency added: “These risks are serious enough to require immediate patching across United States Government departments and agencies.”

The UK National Cyber Security Centre gave similar advice and told organizations to check for “backdoors installed by an attacker.”

Its counterparts in the EU and Australia also issued similar alerts.

Japanese Prime Minister Sanae Takaichi wrote on X: “We have an urgent request for everyone to take action tonight.”

She added: “If it is difficult to apply the fix patch promptly, temporarily suspending websites and similar measures can be considered an effective way to reduce risk.”

How did AI find the bugs?

Researchers at Calif and Wiz used advanced AI tools to analyze code and locate the vulnerabilities.

The tools can identify flaws much faster than humans or older systems, the report said.

UNSW Sydney researcher Salil Kanhere said: “Modern software is incredibly complex, and some vulnerabilities can remain undetected for years.”

He added: “The underlying bugs weren't new; what changed was our ability to find them.”

OpenAI said the incident “highlights how AI can uncover security flaws” but also showed how AI can “help attackers rapidly develop offensive tools and exploits.”

OpenAI, the ChatGPT maker, released a program to check whether PHP installations were secure.

Ryan Ko of the University of Queensland’s Cyber Research Centre tied the problem to legacy software development.

Ko said: “Many of these flaws stem from the way software were built in the past, which were built for functionality and not with security mind.”

What should operators and users do?

Website owners were urged to secure their systems with the latest version of PHP.

The US National Security Agency urged “heightened awareness” during the coming weeks and close monitoring of software-vendor updates.

It said: “Vigilance in applying patches related to those systems is paramount.”

Kanhere said the main responsibility rested with website operators.

Users should follow security advice from affected services, including requests to change passwords, he said.

He also warned of phishing messages exploiting the publicity surrounding the incident.

With technical details now public, Kanhere expects more exploitation attempts in the coming weeks.

The immediate test is whether operators can patch systems, check for backdoors and monitor vendor updates before those attempts spread.