Government websites in Europe and elsewhere
went offline on Wednesday after the disclosure of critical vulnerabilities in a
widely used programming language sent website operators around the world
scrambling to protect their systems.
Developers of the PHP programming language on
Wednesday released urgent new fixes to vulnerabilities that had been lurking in
their software for years until they were uncovered using AI, saying all users
were “encouraged to update immediately.” With tech firms warning that some
hackers were already exploiting the flaws, government agencies across Europe
were among those that took sites offline as a precaution.
Because a fix is now public and artificial
intelligence tools are able to reverse engineer the bug with little effort,
experts said they were bracing for a wave of intrusions as hackers jumped to
get ahead of the updates.
AI was powering a “race to exploit,” said
Costin Raiu, co-founder of cybersecurity research and incident response firm
TLP:Black. He said the next step was the “mass compromise of every vulnerable
web server on the internet.” PHP — a language that dates back to the early
1990s and initially stood for “Personal Home Page” — underpins huge parts of
the public-facing web and is baked into WordPress, Drupal, Joomla and Magento
sites, meaning any critical vulnerability potentially has enormous knock-on
consequences.
“All servers using any
version of PHP released in the last 20 years will be vulnerable,” said Tiffany Farriss, the
interim chief executive of the Drupal Association. “This issue impacts the
majority of the internet.” Cybersecurity agencies around the world have urged
PHP users to update immediately or take websites offline until patches can be
applied.
According to data from Censys, the internet
intelligence firm, about 1.5 million out of 2.6 million hosts report running a
version of PHP for which there is no fix.
The Dutch cybersecurity agency itself went offline, saying it had done so as a
precaution because of the vulnerabilities. The operator of the online
encyclopedia Wikipedia also said it had taken down an unspecified number of
systems until they could be safely patched, while the Internet Archive, the
sprawling online library, said it also briefly went offline to deal with the
issue.
Even some world leaders weighed in. The Dutch
prime minister said he was closely monitoring the situation. Japanese Prime
Minister Sanae Takaichi in a post on X said website owners should “check
whether your live site uses PHP and prepare to apply the new fix.”
The flaw in PHP was discovered using artificial
intelligence, two cybersecurity companies said in independent reports. Calif
said in a blog post it found the flaws with the help of a large language model
on August 1 and had been working on a fix ever since.
Alphabet-owned
(GOOGL.O) cybersecurity company Wiz said in a blog post
that it too had discovered it with the help of Wiz Atlas, its autonomous AI
vulnerability research tool, as well as Google’s Gemini 4 Argon and OpenAI’s
GPT-5.6 Sol. The vulnerabilities remained hidden in the PHP codebase for more
than a decade and would have been extraordinarily complicated for a human hacker to take advantage of, Wiz’s
post said.