PHP flaws found with AI trigger global security warnings

PHP developers released emergency security patches on Wednesday, 21 October, after researchers using artificial intelligence uncovered longstanding flaws that could allow attackers to seize control of affected web servers without authentication. BBC News reported that governments and security agencies worldwide urged website operators to install the fixes immediately or consider taking vulnerable systems offline.

The discovery prompted precautionary shutdowns across public services and online platforms. Wikimedia took some systems offline, while websites or pages operated by the Finnish government, Edinburgh council and the Netherlands’ cybersecurity agency were also withdrawn. Several Scottish councils and health boards took similar steps.

Researchers at cybersecurity firms Calif and Wiz discovered the vulnerabilities using advanced AI tools. Some of the flaws had reportedly remained undetected for more than a decade. Details leaked online this week, accelerating the developers’ public announcement and release of fixes.

What PHP does—and why the risk is significant

PHP, short for PHP: Hypertext Preprocessor, is widely used to build websites, including online shops and services running on WordPress. Wikipedia also uses the language. It works on the server side, helping retrieve and process information before presenting it to a visitor.

The reported vulnerabilities could enable unauthenticated access to affected web servers and expose sensitive information. Gorilla Cyber Security chief executive Paul Spain estimated that millions of websites could be affected, while warning that AI could make attacks faster and easier.

That estimate is not a confirmed count of vulnerable or compromised websites. Nor do the precautionary shutdowns establish that the organisations involved suffered a breach. The report does not identify affected PHP versions or provide vulnerability identifiers, so operators need vendor guidance to determine their own exposure.

Authorities urge patching, isolation and checks for intrusion

The US National Security Agency advised organisations using PHP to take systems offline if they could not patch immediately. It warned that the vulnerability could give attackers a route into a system’s database and called for urgent fixes across US government departments and agencies.

The UK’s National Cyber Security Centre issued similar advice and urged organisations to check for backdoors left by attackers. Authorities in the EU, Singapore and Australia also issued alerts.

Japanese Prime Minister Sanae Takaichi asked people to establish whether their publicly accessible websites used PHP. In a post on X, she said temporary suspension could reduce risk where fixes could not be installed promptly.

Amazon said it had faced multiple attempts to exploit the issue in the days before public disclosure. How the potential attackers learned about the vulnerability remains unknown; the account does not establish that those attempts succeeded.

AI exposes old bugs—and could accelerate attacks

The researchers used AI to examine code and identify weaknesses more quickly than human review or older tools could. UNSW Sydney cybersecurity researcher Salil Kanhere explained that the bugs themselves were not new: the ability to detect them had improved.

Wiz characterised the vulnerabilities as the most severe yet detected by AI. OpenAI, whose technology was used in the discovery, described the issue as particularly consequential and said it had released a program to help check PHP security. Those assessments are the companies’ own characterisations, not an independent severity ranking.

OpenAI also warned that the same technology could help attackers develop exploits rapidly. Kanhere expected further exploitation attempts in the coming weeks as technical details became public. Experts cautioned that smaller organisations with limited security resources and poorly maintained websites could be especially exposed.

What website operators and users should do

The immediate responsibility rests with website operators: establish whether their systems are affected, apply the relevant PHP security updates and follow vendor and cybersecurity-agency advice. Spain described the patch as a relatively small, routine change for most technical teams, while authorities urged continued monitoring for related updates and signs of intrusion.

For Indian businesses and public-service operators using PHP, the practical relevance is the same: exposure depends on their software and configuration, not their location. The report identifies no Indian outage or confirmed Indian breach.

Ordinary users should watch for security instructions from services they use, including any request to change passwords following an incident. Kanhere also warned that criminals could exploit publicity around the flaws with phishing messages.