Websites Takedown Worldwide Amid Critical PHP Security Flaw
Global websites taken offline as governments urge urgent fixes for critical PHP security vulnerabilities, discovered by AI.
International governments and agencies have issued urgent calls for websites to address two critical cyber-security flaws discovered in the PHP programming language, a foundational element for a significant portion of the internet. A fix was released on Wednesday afternoon, but many organizations unable to apply it immediately were advised to take their sites offline.
These vulnerabilities pose a severe risk, potentially offering direct pathways to a server's file system or database. The flaws were identified by artificial intelligence, with cyber-security firm Wiz describing them as the most significant vulnerabilities ever discovered by AI technology, which is rapidly transforming the cyber landscape.
In response, multiple entities have temporarily disabled their online presences. Finland has shut down its public government web services, while the Netherlands' cyber-security agency has taken its own website offline. The U.S. National Security Agency recommended that organizations take systems offline if immediate updates were not feasible. The White House confirmed that federal agencies are collaborating with leading AI laboratories to expedite a resolution.
Japan's Prime Minister, Sanae Takaichi, urged individuals to verify if their publicly accessible websites utilize PHP. The Wikimedia Foundation, responsible for Wikipedia, confirmed it is actively addressing the vulnerabilities and has taken several other systems offline as a precaution until they can be securely patched, leading to temporary access issues for some users.
Other organizations, including Edinburgh council and specific BBC program websites like Doctor Who and The Traitors, have also become inaccessible. While these entities have not explicitly confirmed a link to the PHP flaws, the BBC has reached out for comment. Online platforms such as DeviantArt have also announced temporary maintenance without specifying the cause.
The vulnerabilities were unearthed by cyber-security researchers from firms Calif and Wiz. Calif, in collaboration with the PHP Foundation, participated in OpenAI's 'Patch the Planet' program, gaining access to advanced AI tools to identify and rectify flaws in web development languages. OpenAI stated that this discovery represents one of the most impactful security issues in recent history.
An internal researcher at OpenAI also identified the issue around the same time as the external firms. These critical flaws had remained undetected for over a decade, with advanced AI tools enabling their discovery within weeks by August. Wiz highlighted the crucial role of frontier AI models in developing and adapting working exploits across various applications rapidly.
Wiz has estimated that approximately 70% of the internet could be affected by these vulnerabilities, though this figure remains unverified by the BBC. The PHP Foundation had planned to release its findings and a complete fix later this month, a process typically involving extensive coordination and a detailed disclosure.
This article was written by AI based on publicly available news reporting. Original reporting by the linked source.
