In brief
A routine AI search exposed severe PHP security flaws that threaten nearly 70% of the web. A patch was released, but many sites—such as the Finnish public‑services portal, BBC webpages, and parts of Wikipedia—went offline pending updates. Global security agencies, including the NSA, UK NCSC, and EU CERT, issued advisories urging immediate action, while experts warned of high‑risk remote‑code execution. The incident highlights the need for rapid patching and continuous monitoring of legacy PHP versions.
Global internet sites have gone dark as governments worldwide urge immediate action after an AI‑driven search uncovered critical vulnerabilities in PHP.
The flaw – a high‑risk remote‑code‑execution bug that could let attackers easily hijack servers – was discovered by the security firm Wiz in collaboration with OpenAI’s AI‑toolset.
A patch was issued mid‑week, but agencies have warned that sites unable to apply it instantly must disable the affected services to avoid potential exploitation.
The Finnish government temporarily shut its public web services, the BBC paused several of its programmes’ web pages, and the Wikimedia Foundation took parts of Wikipedia offline as precautionary measures.
The U.S. National Security Agency and the UK’s National Cyber Security Centre (NCSC) both released advisories on social‑media platforms instructing organisations to either update or take their sites down. The NCSC also urged continuous monitoring of third‑party software that bundles PHP.
Experts estimate that roughly 70% of the internet runs on now‑affected PHP versions – dating back to PHP 5 released in 2004. While the PHP Foundation has pushed a fix for the latest releases, users on PHP 8.1 or older are told to upgrade immediately.
“PHP is everywhere – from WordPress to Magento and even hidden behind many hosting platforms,” said a senior Huntress consultant. “This is one of the most severe vulnerabilities discovered in recent memory.”
Security labs are already monitoring for early attacks. Cloudflare’s chief technology officer noted that new attack vectors are emerging as the patch is rolled out.
The incident marks a stark reminder that even long‑standing software can harbour lethal risks when not kept up to date, and that AI‑assisted vulnerability hunting can trigger global crises in seconds.
