Two critical vulnerabilities in PHP have prompted the shutdown of several websites across multiple countries. Cybersecurity teams are working to secure systems using emergency fixes. Researcher Ryan Austin said it was "the most serious vulnerability I've ever found." These flaws could allow attackers to gain control of many vulnerable websites.
Synopsis
Two critical vulnerabilities in PHP have prompted the shutdown of several websites across multiple countries. Cybersecurity teams are actively working to secure these potentially affected systems using emergency fixes provided by the PHP Foundation. Major organizations, including Wikimedia and government sites in Finland and the Netherlands, have taken precautions. Researchers utilized artificial intelligence to identify these security flaws, showcasing both its benefits and risks.
Two serious security flaws in PHP, the programming language behind millions of websites, have sparked a global cybersecurity response. A number of government portals, public services and other websites have been shut down as teams work to secure their systems.
The discovery also highlights the growing role of intelligence in cybersecurity. Researchers used tools to find problems that people had missed for many years. The same artificial intelligence could also help bad people find and use security problems faster. The information is taken from the BBC and Detroit News.
What is a PHP vulnerability?
PHP is a free, open-source programming language that helps websites work behind the scenes. It allows servers to process information and deliver web pages to visitors. Popular platforms such as WordPress, Wikipedia, online stores and government websites rely on it.
Cybersecurity firm Wiz estimates that PHP is used by around 70% of websites worldwide. With so many sites depending on the language, even a small number of serious flaws can create widespread security concerns.
Live Events
You Might Also Like:
U.S. State Department China travel advisory: Key points to note for Americans planning a trip to China
The two vulnerabilities, known as “php2shell,” could allow attackers to run commands on affected servers without needing a password or user account. Both flaws received a severity score of 9.2 out of 10 under the CVSS v4.0 system.
If criminals exploit these weaknesses, they could gain control of vulnerable websites, steal sensitive data, alter web pages or compromise entire systems. Smaller websites with limited security resources could be particularly difficult to protect.
Ryan Austin, a researcher at Calif who helped uncover the issue, told the BBC it was "the most serious vulnerability I've ever found".
Wiz described the flaws as the "most severe" ever detected by AI, while OpenAI called the discovery "one of the most impactful security issues in recent memory."
You Might Also Like:
Super typhoon Champi packs 240 km/h winds: 5 facts about the powerful Pacific storm
Which websites have been affected by the PHP security flaws
The discovery has already prompted precautionary shutdowns in several countries. Wikimedia, the organisation behind Wikipedia, took some systems offline. Government websites in Finland and the Netherlands, Edinburgh Council and the University of Geneva were also affected. Several public organisations in Scotland, including councils and health boards, temporarily shut down their websites.
Cybersecurity agencies are urging organisations to install emergency fixes released by the PHP Foundation. The US National Security Agency advised organisations to take vulnerable systems offline if they could not apply the patches immediately. The UK's National Cyber Security Centre also urged organisations to check for signs that attackers may have installed backdoors.
Cloudflare chief executive Matthew Prince reported a steep increase in attempted attacks after details of the flaws became public. He said the number had risen from thousands before disclosure to millions afterwards.
You Might Also Like:
Ramaswamy ad controversy: Amy Acton’s mother commercial sparks backlash-here's how Amy Acton, her brother and critics responded as Ohio Governor polls tighten
Amazon also reported several attempts to exploit the vulnerabilities before they were publicly announced. Its websites, however, continued operating normally.
How did AI help researchers find the flaws
Researchers at Calif worked with OpenAI to identify the first vulnerability and reported it to PHP on August 11. The discovery was made using OpenAI's GPT-5.6 Sol model, according to the company. Wiz later identified another flaw independently and reported it on August 24, also using AI tools.
The discoveries show how AI can help researchers examine complicated software code and spot weaknesses that might otherwise remain hidden for years.
As cybersecurity researcher Salil Kanhere from UNSW Sydney told the BBC: "The underlying bugs weren't new; what changed was our ability to find them."
However, the technology has a more troubling side. The same tools that help security experts uncover flaws could also make it easier for attackers to develop ways to exploit them. OpenAI said the incident highlights how AI can help identify security problems while also assisting those who want to take advantage of them.
What should website owners and everyday users do
The PHP Foundation has urged users to install the security fixes right away. Website owners should check if their servers are running versions of PHP that are affected and make sure the required patches have been applied.
If people depend on a hosting company or a web developer they should contact them to confirm that the systems are secure. Updating WordPress or its plugins will not fix a problem in PHP itself.
If a website cannot be made secure quickly taking it offline for a time may help lower the risk.
There is no need to make changes by themselves. Still it is important to pay attention to security alerts from websites they use. They should also stay alert, to phishing emails or messages that try to take advantage of this situation.
The global business of promising more
One company, 2 words. Bond yield and CDS: Will they decide the fate of global markets?
Business of Odd Things: Inside an industry that farms fish that nobody is meant to eat
War's second-order effects are becoming visible in critical sectors
US mid-term elections – Part 2: What does it mean for Trump to lose control of Congress?