Key facts
- Flaws in PHP, used by millions of websites, allow attackers to take control of servers.
- AI tools were instrumental in discovering the vulnerabilities.
- Website operators are advised to install emergency patches or take platforms offline.
- The US NSA warned the flaw provides a direct path to exploit a system's database.
Severe, long-undetected flaws in the PHP programming language, which powers a vast number of websites globally, have been brought to light by artificial intelligence. Cybersecurity firms, including Wiz and Calif, utilized AI tools to identify these vulnerabilities, described as the most severe ever detected by AI. The flaws could allow attackers to gain unauthorized control of web servers and steal sensitive data. This discovery has triggered a global cybersecurity alert, with governments and agencies urging website operators to apply emergency patches or take their platforms offline. Organizations like Wikipedia, the Finnish government, and Edinburgh council have already taken precautionary measures by disabling some of their systems. Developers of the PHP platform have released patches to address the vulnerabilities, emphasizing the need for immediate updates.