Two critical vulnerabilities in PHP, a programming language powering a significant portion of internet infrastructure, were discovered and disclosed on Wednesday, triggering widespread precautionary measures across governments and major digital platforms. The flaws were identified through artificial intelligence tools as part of a collaborative program initiated by OpenAI, with cybersecurity firms Calif and Wiz credited as the primary discoverers. The vulnerabilities had remained undetected for over a decade before being found through advanced AI capabilities.
Multiple national governments and international cybersecurity agencies responded to the threat by recommending that organizations either immediately apply available security patches or temporarily take affected systems offline as a precaution. Finland temporarily shut down its government web services, while Dutch authorities took government websites offline, including the parliament’s site. In the United Kingdom, the National Cyber Security Centre issued similar guidance, as did counterparts in the European Union, Australia, and Japan. The US National Security Agency advised organizations unable to immediately update to consider taking systems offline, noting that the vulnerabilities could provide attackers with direct access to server file systems or databases.
Several high-profile websites implemented precautionary downtime in response. The Wikimedia Foundation, which operates Wikipedia, took certain systems offline while applying patches, causing temporary access disruptions. The BBC’s website and pages for programs including Doctor Who and The Traitors became unavailable. Edinburgh Council’s website also went offline. Other platforms, including the art site DeviantArt, reported temporary maintenance without explicitly confirming a connection to the PHP vulnerabilities.
Security experts highlighted the challenge organizations face in locating and securing every instance of PHP running within their infrastructure, as the language is often embedded in content management systems, hosting platforms, and third-party software without being immediately visible to operators. Early cyberattacks exploiting the vulnerabilities were already emerging according to reports from infrastructure providers. The PHP Foundation had planned to release full patch details later in the month but accelerated its timeline after vulnerability information leaked on social media. Organizations running PHP 8.1 or older versions were advised to upgrade, though uncertainty remained regarding which legacy versions required updates.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI