In brief
A hitherto hidden flaw in PHP, the backbone of countless websites, was exposed by artificial intelligence tools. The vulnerability allows attackers to hijack servers without authentication, causing a worldwide safety alert that reached governments, the NSA, the UK's NCSC and other security bodies. Major platforms from Wikipedia to federal government portals shut down for weeks while patches rolled out. Webmasters are urged to upgrade instantly, while the public should watch for phishing attempts exploiting the buzz.
For more than a decade tiny bugs had slipped through the cracks of PHP, the scripting language that powers Wikipedia, WordPress and countless online stores. These glitches, however, stayed hidden until advanced AI tools sifted through millions of lines of code and found a dangerous flaw that lets attackers seize control of web servers with no credentials.
What is PHP?
PHP—short for PHP: Hypertext Preprocessor—runs behind the scenes on the majority of the internet. From e‑commerce sites to government portals and open‑source projects, the language collates data and presents it to users in a readable format. When a flaw in PHP permits unauthorised access, any site that relies on it could be compromised.
Who has been affected?
Major services have paused operations: Wikimedia shut several systems, governments in Finland, the Netherlands and the UK pulled their websites offline, and even major publishers have temporarily suspended their platforms. Smaller sites with limited security budgets may find their servers especially vulnerable.
The global response
The PHP developers pushed a patch to fix the bugs within hours. Security agencies—including the USPNSA, the UK’s National Cyber Security Centre, and partners in the EU, Singapore and Australia—issued immediate advisories. The NSA warned that organisations not able to patch promptly should take sites offline, citing a “direct path” to database exploitation.
Staying safe
Website owners must apply the latest PHP version before the end of the week. Users should stay alert for any password‑reset links or emails that appear suspicious, as the incident has already spawned phishing campaigns. Security researchers emphasise that the real danger is the potential for widespread exploitation once many vulnerable sites remain unpatched.
How AI uncovered the weakness
Researchers at the security firms Calif and Wiz leveraged proprietary AI models to comb through PHP’s code base. These systems analyse millions of lines of code at a fraction of the time it would take a human, flagging logical inconsistencies that lead to security gaps. While the flaws themselves were not new, the AI’s speed and scale made the discovery inevitable.
Looking ahead
With the AI tools now publicly described, attackers may race to craft exploits for the weakness. Experts advise continuous monitoring of security patches and rapid response to any anomalous server behaviour. The incident has highlighted both the power of AI to find critical bugs and its potential to accelerate the reach of those who wish to weaponise them.
