In brief
In a startling cyber‑security alert, advanced AI tools uncovered severe long‑standing flaws in PHP, the scripting language that powers millions of websites, from Wikipedia to e‑commerce giants. The revelation sent a global scramble as governments, security agencies and web operators rushed to apply emergency patches or take sites offline. Experts warn that the vulnerabilities could allow attackers to gain unauthorised control of server data and even weaponise the flaw for mass‑scale attacks. The incident underscores both the power of AI to find hidden bugs and the urgent need for secure coding practices and rapid patch deployment.
For more than a decade, serious flaws had gone undetected in the core software that powers parts of the web. An artificial‑intelligence (AI) code‑analysis system finally exposed a series of vulnerabilities in PHP – a language that remains a backbone for sites such as Wikipedia, WordPress and countless online stores.
The flaws, uncovered by security researchers at the firms Calif and Wiz, allow an attacker to execute arbitrary code on a server without any authentication. Once hijacked, the attacker can steal database contents, alter site data or install back‑doors, giving a powerful tool for further attacks.
The discovery triggered an unprecedented panic. High‑profile sites – including the Wikimedia Foundation’s servers, several government portals, popular gaming platforms and even the BBC – were temporarily taken offline. Authorities worldwide urged web operators to apply the emergency patch provided by the PHP developers or, if that was not possible, to suspend their sites until the fix could be installed.
U.S. agencies such as the National Security Agency and the National Cyber Security Centre in the United Kingdom advised all PHP‑based organisations to patch immediately and to check for any signs of compromise. Similar warnings came from the EU, Singapore, Australia and Japan, with Prime Minister Sanae Takaichi tweeting a call for site owners to confirm whether they run PHP.
The AI‑driven discovery highlights how modern machine‑learning tools can sift through vast codebases and find bugs that have lurked for years. While the software itself existed for decades, it was the AI’s ability to analyse code at scale that brought the risks to light – and, conversely, how it could enable attackers to rapidly craft exploits.
For operators, the advice is clear: update to the latest PHP version immediately and monitor logs for any suspicious activity. If patching is not feasible, temporarily de‑activate vulnerable services. Users who encounter phishing email campaigns exploiting the explanation should verify the source and strengthen passwords on affected sites.
The episode serves as a stark reminder that secure code practices, timely updates, and vigilant monitoring remain the frontline defence against ever‑evolving cyber threats.
