Two critical security flaws discovered in PHP, a programming language used across much of the internet, have prompted international governments and cyber-security agencies to take websites offline as a precaution. The vulnerabilities were found within PHP and a fix was issued on Wednesday afternoon. Cyber-security firm Wiz described them as the most severe vulnerabilities ever discovered by artificial intelligence technology. The flaws had gone undetected for more than a decade before being identified by August, after researchers gained access to advanced AI tools through a program started by OpenAI called Patch the Planet. Wiz estimated that roughly 70 per cent of the internet is affected, though this figure could not be independently verified.
The discovery prompted immediate action from authorities worldwide. Finland temporarily shut down its government's public web services, while the Netherlands' cyber-security agency took its own website offline. Japan's Prime Minister Sanae Takaichi urged people to check if their publicly available websites ran on PHP. The UK's National Cyber Security Centre, along with counterparts in the EU and Australia, urged organisations using PHP to apply fixes immediately, or to consider taking systems offline until they could be fully patched. The US National Security Agency issued similar guidance, noting that these vulnerabilities often provide direct access to server file systems or databases.
Major websites and services have already gone dark. The Wikimedia Foundation, which runs Wikipedia, said it had taken down a number of systems as a precautionary measure until they could be safely patched, leaving some people unable to access parts of Wikipedia on Wednesday. Edinburgh council's website became inaccessible, as did online platforms for several BBC programmes including Doctor Who and The Traitors. Other websites, including art platform DeviantArt, said they were temporarily down for maintenance without specifying the reason.
The scale of the challenge facing organisations is substantial. Cyber-security expert Don Smith from Sophos Counter Threat Unit told the BBC that finding and managing every instance where PHP was running would be a major undertaking, as the language can sit beneath public websites, content management systems and hosting platforms sometimes without being obvious to the organisation using it. The flaws could potentially allow hackers to install malware and take down websites through unauthenticated remote code execution. Cloudflare's chief technology officer said early attacks were already emerging. The PHP Foundation has issued updates only for the latest versions, with users of PHP 8.1 or older being urged to upgrade.
For UK users, organisations and businesses, this means websites and online services may be temporarily unavailable while critical security updates are installed to prevent potential cyber-attacks.